IM
IronMonkey Threat Research
‹ Back to ICS Advisories

dynovaPRO™ Reset Credentials Vulnerability

CRITICAL
CVSS 9.1
Date 2026-09-17T00:30:00+00:00
Source abb-psirt
Published by ABB PSIRT

// Description

ABB is aware of public reports of a vulnerability in the product listed as affected in the advisory. An update has been deployed to the cloud system that resolves a publicly reported vulnerability in the product versions listed above. An attacker who successfully exploited this vulnerability could take remote control of the product. The vulnerability has been identified in the keycloak authentication component which is integrated into dynovaPRO™. The vulnerability exists in the 'Forgot Password' functionality and allows unauthenticated attackers to bypass authentication and hijack user accounts. Users who have received a password reset mail before the mentioned date, without having requested it, are thereby potentially attacked by exploiting this vulnerability. ABB investigated potentially malicious user reset activities and blocked those user access immediately to reduce the exploitation risk. The credentials of those users have been deleted after the software fix was deployed and the users were informed that they must reset their password to gain access to dynovaPRO™ again.

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2026-18963 9.1 critical
CVE-2026-18963. A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

// Affected Products (1)

Vendor Product Asset Type Purdue Level Firmware
Siemens Unknown rtu
L1
--

// Remediations (10)

Mitigation: The following conditions reduce the risk of exploitation of this vulnerability: - Limited Attack Su
The following conditions reduce the risk of exploitation of this vulnerability: - Limited Attack Surface: The vulnerability is specific to the password reset functionality. Other authentication methods are not affected. - Email Notifications: Legitimate users receive email notifications during password reset attempts, which may alert them to unauthorized access attempts. Refer to section “General security recommendations” for further advise on how to keep your system secure.
Patch: The problem is corrected in the dynovaPRO™ cloud system since 2026-08-27 12:00 (CEST). Users who ha
The problem is corrected in the dynovaPRO™ cloud system since 2026-08-27 12:00 (CEST). Users who have received a password reset mail without their consent should reset their password to ensure an attacker did not gain access to their account.
Workaround: Workarounds are specific measures that a user can take to help block an attack, for example, tempora
Workarounds are specific measures that a user can take to help block an attack, for example, temporarily disabling the vulnerable feature may remove the exposure with well-known impact on functionality. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”. ABB has implemented temporary mitigation measures for customers: - Password Reset Function disabled: The password reset functionality has been disabled for all dynovaPRO™ customers to prevent exploitation of this vulnerability as a short term step, until software update has been carried out. - Account Monitoring: Users are advised to monitor their user account activity for any unauthorized access. Note: These workarounds do not eliminate the underlying vulnerability until it has been fixed in dynovaPRO™.
Patch: Update to V2.2.2 or later version
Update to V2.2.2 or later version
Patch: Vulnerability mitigated with firewall rules on 2026-08-26 and fixed with update on 2026-09-02; no us
Vulnerability mitigated with firewall rules on 2026-08-26 and fixed with update on 2026-09-02; no user actions necessary
Mitigation: Configure a Web Application Firewall (WAF) or Reverse Proxy If complete blocking of internet access
Configure a Web Application Firewall (WAF) or Reverse Proxy If complete blocking of internet access is not immediately feasible, you can use a Web Application Firewall (WAF) or a Reverse Proxy to block the affected path. Please configure your WAF or Reverse Proxy to block the following path: /auth/realms/customer/login-actions/reset-credentials Please note that by blocking this path, the password reset functionality will be unavailable.
Patch: Update to V2.9.1 or later version
Update to V2.9.1 or later version
Mitigation: Deactivate Password Reset in Keycloak Realm Settings Deactivate the password reset functionality dir
Deactivate Password Reset in Keycloak Realm Settings Deactivate the password reset functionality directly within the Keycloak realm settings. To do this, navigate to: Identity & access management > realm settings > Login > Forgot password > Off Please note that by deactivating this setting, the password reset functionality will be unavailable.
Patch: Update to V1.15.20 or later version
Update to V1.15.20 or later version
Mitigation: Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to blo
Block direct internet access to IEM Pro / IEM Virtual The most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.

// References