CVE-2024-48841

This exploit demonstrates an authenticated remote code execution vulnerability in ABB Cylon FLXeon controllers via command injection in the /api/users/password endpoint. The newPassword parameter is improperly escaped before being passed to ChildProcess.exec() within a usermod command, allowing arbitrary command execution.

This exploit demonstrates authenticated remote code execution (RCE) in ABB Cylon FLXeon BACnet controllers via command injection in the /api/timeConfig endpoint. The PoC uses curl to send maliciously crafted JSON payloads with backtick-enclosed commands in multiple fields, exploiting improper input validation in timeConfig.js.