ABB Ability Edgenius Update Fixes Linux Kernel Root Escalation

En bref

• CVE-2026-31431 is a Linux kernel privilege escalation flaw affecting ABB Ability Edgenius.
• A local authenticated user or compromised container workload can gain root and full system control.
• Affected versions listed include 3.2.0.0 and 3.2.4.1; an update is available.
• The CISA advisory covers critical infrastructure sectors, but any deployment should be reviewed.
• No remote exploit is described; local access or container compromise is required.

ABB has published an update for a publicly reported Linux kernel vulnerability tracked as CVE-2026-31431, also called Copy Fail. The flaw affects ABB Ability Edgenius, and CISA has issued an ICS advisory describing the issue. According to the advisory, a locally authenticated user or a compromised container workload could exploit the vulnerability to gain elevated root privileges. Once root access is achieved, the attacker can effectively take complete control of the affected system.

The advisory lists ABB Ability Edgenius versions 3.2.0.0 and 3.2.4.1 as affected. The product is deployed worldwide and is associated with critical infrastructure sectors including critical manufacturing, energy, water and wastewater, and chemical. For K-12 districts, direct exposure depends on whether they run ABB Ability Edgenius in building automation, industrial control, or other operational technology environments. Districts that do not use the product are unlikely to be affected, but they should confirm that no related systems are present.

This matters because root-level access can let an attacker change configurations, disable security controls, install persistence, or move laterally to other systems. The vulnerability requires local access or a compromised container, so it is not a remote, unauthenticated exploit. However, a compromised container can provide that initial foothold, making container security and least privilege important. The advisory assigns a CVSS v3 score of 7.8 and CISA currently classifies the issue as medium severity.

Administrators should treat the vendor update as the primary fix. If patching cannot be done immediately, restrict local access to affected systems, segment them from broader networks, and monitor for unexpected privilege changes or container activity. Review logs for signs of root escalation and verify that container workloads run with minimal permissions. Watch the ABB and CISA advisories for any updates or revised affected version lists.

À faire maintenant

1. Inventory all ABB Ability Edgenius instances and confirm whether any run versions 3.2.0.0 or 3.2.4.1.
2. Apply the vendor-provided update as soon as possible, following ABB's installation guidance.
3. If immediate patching is not possible, restrict local login access and isolate affected systems from untrusted networks.
4. Review container workloads for unnecessary privileges and enforce least-privilege policies.
5. Monitor system and container logs for unexpected root-level activity, privilege escalation, or configuration changes.
6. After patching, verify the installed version and confirm the vulnerability is resolved.
7. Coordinate with OT, facilities, or ICS teams if the product supports operational technology environments.

Références CVE

• CVE-2026-31431

Source originale

CISA Advisories