CVE-2023-5778

CVE-2023-5778 is an improper handling of length parameter inconsistency (CWE-130) in the communication handling of ABB Freelance Controllers, affecting the DCP, AC700, AC800, and AC900 controller families across Freelance releases from 2013 through 2019 SP1. A remote, unauthenticated attacker can send network traffic with inconsistent length parameters to the controller, triggering a fault with no user interaction or privileges required. Per the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N with high availability and safety impact), the practical outcome is a crash or denial of service of the controller, and because these devices run industrial processes, the disruption can carry safety consequences in plants using Freelance as their DCS. All organizations running Freelance controllers on the affected releases are potentially exposed, though exploitation requires network reachability to the controller. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; ABB (the assigning CNA) has published the advisory.

What to do: Upgrade affected Freelance controller systems to a fixed release as specified in ABB's security advisory (anything beyond the listed releases through 2019 SP1). Until patched, restrict network access to controller communication ports via firewalls and OT/IT segmentation, and ensure the controllers are not reachable from untrusted networks or remote-access paths. Inventory plants for AC700/AC800/AC900/DCP controllers running Freelance 2013–2019 SP1 and treat an unexpected controller crash or reboot as a possible exploitation indicator.