The Quiet Port That Could Map a Plant: ABB Gateway Default Exposed PLC Discovery
A Windows gateway used in industrial engineering was found listening on TCP/1217 by default, turning a convenience feature into a network-reachable reconnaissance point.
Industrial attackers do not always need a dramatic exploit chain. Sometimes they only need a service that was meant to be local, but shipped ready to answer on the network. That is the core problem behind CVE-2024-41975 in ABB Automation Builder Gateway for Windows: a default setting that could let a network-accessible attacker look around a PLC environment without first breaking into the control logic itself.
Fast Facts
- CVE-2024-41975 affects ABB Automation Builder Gateway for Windows and is rated CVSS v3.1 5.3, Medium.
- The gateway listens on all available network adapters on TCP port 1217 by default.
- ABB says an attacker with network access could search for PLCs on reachable segments.
- Direct PLC access remains protected by PLC user management unless that control is disabled.
- Automation Builder 2.9.0 changes the default to local access only.
Why the flaw matters
ABB describes the gateway as a communication channel between engineering clients and AC500 PLCs. In the affected setup, the service binds beyond localhost and becomes reachable from the network. That matters because it shifts the threat from a purely local workstation issue to a reachable industrial discovery surface.
MITRE’s CWE-1188 label fits the pattern neatly: the weakness is not a buffer overflow or authentication bypass, but an insecure default. From a defensive perspective, that is often harder to spot than a traditional bug because the software appears to be working as designed. The danger is in how broadly it is designed to listen.
The advisory also notes that the same gateway may arrive bundled with CODESYS Development System V3 or CODESYS OPC DA Server setups. That means defenders should not limit their inventory to a single product name. In practice, the risky component may be sitting on an engineering PC under a different package label.
At the time the advisory was issued, ABB had not received information indicating exploitation. Even so, the case is a useful reminder that a service bound to all interfaces can be very different from one bound to 127.0.0.1. If TCP/1217 is reachable from adjacent networks, it may allow asset discovery across a segment that operators assumed was private.
Defensive lessons
The practical fix is straightforward: upgrade to Automation Builder 2.9.0 or later, or set LocalAddress=127.0.0.1 in the [CmpGwCommDrvTcp] section and restart the gateway. Network teams should also treat TCP/1217 as an engineering-only service and keep it behind segmentation and host firewall rules.
The broader lesson is that OT exposure often starts with the engineering layer, not the controller itself. If a gateway can enumerate PLCs, it can help an intruder understand what exists, where it sits, and which paths matter most. That is why secure defaults are not a cosmetic feature; they are part of the control system’s perimeter.
Conclusion
This advisory is a reminder that in industrial environments, visibility can be a vulnerability even when direct control is still blocked. A local-only default would have reduced that risk from the start. For defenders, the lesson is simple: audit gateways, not just endpoints, and assume every exposed engineering port can become a map of the plant.
TECHCROOK
Hardware firewall appliance: A dedicated firewall can help keep engineering PCs, PLC networks, and office systems in separate zones. Look for VLAN support, logging, VPN options, and rules that let you restrict management ports to only the hosts that need them.
WIKICROOK
- PLC: A programmable logic controller that automates industrial processes and machine operations.
- Gateway: A service that bridges clients and devices, often acting as a communication intermediary.
- CWE-1188: A weakness class for resources initialized with insecure default settings.
- Localhost: The local machine interface, usually 127.0.0.1, used to restrict access to the same host.
- Network segmentation: Splitting networks into zones to limit reachability and reduce lateral movement.
