ICS Advisories

Risk evaluation

ABB is aware of publicly reported vulnerabilities in the product listed as affected in the advisory. Updates to the affected component that fixed the vulnerabilities are available. An attacker who successfully exploited this vulnerability could remotely execute code on the server run-ning Dokuwiki. No active exploitations of the vulnerabilities have been reported by the time of writing this document

Mitigation summary

The vulnerabilities are not tight to any specific MES version but solely depend on the delivery including Dokuwiki, which relies on affected PHP versions. The affected PHP versions are listed in CERT-EU - Critical Vulnerabilities in PHP Reference section. The problem is corrected in the following product versions: • PHP 8.5.12 • PHP 8.4.27 • PHP 8.3.36 • PHP 8.2.35 ABB recommends that customers apply the updates immediately. The updates are applied by updating the PHP packages in operating system of the servers that run Dokuwiki. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. PHP is installed on the web server / operating system, so upgrading PHP is a server administration task. It needs to be checked which PHP packages are installed on the system, and upgrade them (depending on the OS, with either ‘dnf’ or ‘yum’). ABB recommends that only PHP packages are updated, not the whole Dokuwiki installation.