CVE-2022-0902: Abb Rmc-100-Lite Firmware

Critical severity, CVSS 9.8. EPSS: 16.9% chance of exploitation in the next 30 days.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.

Affected products

• Abb Rmc-100-Lite Firmware: before 2106229-011 (fixed in 2106229-011)
• Abb Rmc-100 Firmware: before 2105457-037 (fixed in 2105457-037)
• Abb Udc Firmware: before 2106177-007 (fixed in 2106177-007)
• Abb UFLOG5 Firmware: before 2105298-024 (fixed in 2105298-024)
• Abb XFCG5 Firmware: before 2105805-016 (fixed in 2105805-016)
• Abb Xio Firmware: before 2106198-008 (fixed in 2106198-008)
• Abb XRCG5 Firmware: before 2105864-016 (fixed in 2105864-016)

Published 2022-07-21. Last modified 2026-06-17.