> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # ABB Ability Edgenius - URL: https://f4n6.co.uk/security-feed/abb-ability-edgenius/ - Published: 2026-09-17T21:41:22.000Z - Updated: 2026-09-17T21:41:22.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-31431 ## 1\. Executive summary ABB has released Edgenius 3.2.4.1 to fix CVE-2026-31431 ("Copy Fail"), a Linux kernel privilege escalation in the algif\_aead cryptographic interface, affecting ABB Ability Edgenius versions >=3.2.0.0 and <3.2.4.1 on the Edgenius Gateway bE100\. The flaw is scored CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), is publicly disclosed, and is listed in CISA KEV (added 2026-05-01) with an EPSS score of 100%, meaning exploitation is expected imminently. Exploitation requires local access or a foothold in a container workload, but yields root and complete control of the edge node. ABB had no reports of exploitation against Edgenius at publication; the KEV listing and public disclosure still make patching urgent for any EMEA financial services client running Edgenius at branch sites, data centres or OT-adjacent facilities. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk — general principles | ABB Ability Edgenius is an ICT third-party product deployed as an edge platform connecting to control systems and hosting applications, and the fix depends entirely on the vendor's 3.2.4.1 release. | Clients with Edgenius in scope must track the vendor patch through their third-party risk process: confirm affected versions in inventory, obtain and deploy 3.2.4.1, and record the remediation against the provider relationship. | | DORA Art. 17: ICT-related incident management process | CISA KEV listing (2026-05-01) with EPSS 100% converts this from routine patching into a vulnerability with active-exploitation expectation on an edge node that connects to control systems. | Treat unpatched Edgenius gateways as a live incident-management trigger: prioritise detection of local privilege escalation on these hosts and define the escalation path if exploitation is confirmed. | No NIS2 or UK NIS article is engaged on the facts of this item: the advisory describes a vendor patch for an OT/edge product with no reported incident, and nothing here distinguishes a NIS2 Art. 23 or UK NIS reporting trigger from any other patch deployment. ## 3\. Technical analysis & attack chain Confirmed chain, from the ABB PSIRT 7PAA024620 advisory as republished by CISA: 1. The attacker obtains local access to an affected Edgenius node, either as a locally authenticated low-privileged user (physical access or valid SSH credentials) or as code already running inside a compromised container workload on the node. 2. The attacker invokes the Linux kernel's algif\_aead cryptographic algorithm interface. An incorrect "in-place operation" was introduced in this interface, where the source and destination data mappings are different, causing incorrect memory handling in the kernel. 3. The memory-handling flaw allows the attacker to escalate from a normal user to root on the affected system node. 4. With root, the attacker gains complete control of the node: administrative control, arbitrary code execution, or rendering the node unavailable. Technical specifics that matter to a defender: - Affected product: ABB Ability Edgenius >=3.2.0.0 and <3.2.4.1, installed on the ABB Ability Edgenius Gateway bE100\. Fixed in Edgenius 3.2.4.1, which incorporates the upstream Linux kernel security update. - Vulnerable component: the Linux kernel's algif\_aead cryptographic algorithm interface, part of the kernel cryptographic subsystem (AF\_ALG socket family). The upstream fix reverts the in-place operation and returns to out-of-place operation, copying the associated data directly, because the source and destination come from different mappings. - Scope of the kernel flaw: the underlying issue affects kernels used by most major Linux distributions released since 2017, so the exposure is not limited to Edgenius. Any Linux host in the estate on a distribution kernel from that era carries the same flaw. - Attack surface: local only. CISA and ABB both state remote exploitation is not possible; the prerequisite is local code execution. The advisory notes the risk increases in shared, containerised or multi-tenant environments, which is directly relevant to how Edgenius hosts applications. - Mitigating factors specific to Edgenius: by default no additional lower-privilege users exist on Edgenius installations, which narrows the set of accounts that can reach step 1. - Impact: confidentiality, integrity and availability all high once exploited (C:H/I:H/A:H in the vector). Caveats and confidence. The vulnerability mechanics, affected versions and fix are corroborated across the ABB PSIRT advisory, its CISA republication (ICSA-26-260-06, revision 2, 2026-09-17) and an earlier CISA republication (ICSA-26-195-02). Two points are single-sourced or partially sourced. First, the modprobe workaround (disabling the algif\_aead kernel module) comes from the B&R advisory (ICSA-26-174-06), which covers the same kernel flaw on different products; ABB's own advisory does not offer it, so treat it as a researcher-validated measure for the underlying kernel issue rather than an ABB-endorsed Edgenius workaround, and test before use. Second, the B&R advisory states public proof-of-concept exploits exist for these kernel vulnerabilities; that claim is not repeated in the ABB advisory, but it is consistent with the KEV listing and EPSS 100%. ## 4\. Mitigation & containment P1, within 24 hours: - Inventory every ABB Ability Edgenius Gateway bE100 and record the firmware/software version. Anything at >=3.2.0.0 and <3.2.4.1 is affected. - Restrict management access now: limit access to SSH and Cockpit on all Edgenius nodes to named administrative accounts only, per ABB's stated mitigation. Block SSH (TCP 22) and Cockpit (TCP 9090) at the network layer for all source addresses except a dedicated management range. - Review local account lists on each node and remove or disable any non-default lower-privilege accounts. ABB states none should exist by default; any that do are the prerequisite for this exploit. P2, within 72 hours: - Deploy Edgenius 3.2.4.1, the vendor fix, which incorporates the corrected Linux kernel. Schedule the required reboot. ABB recommends applying the update at earliest convenience; the KEV listing and EPSS 100% justify treating it as urgent rather than routine. - If patching cannot complete within the window, apply the temporary kernel-level mitigation validated by security researchers for CVE-2026-31431 (single-sourced from the B&R advisory; test on a staging gateway first, as ABB has not endorsed it for Edgenius): `echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf rmmod algif_aead 2>/dev/null || true` This disables the algif\_aead module and removes the AEAD socket interface from the kernel crypto API. Per the researcher impact assessment it does not affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS or SSH, but applications explicitly configured to use the afalg engine may be affected; verify Edgenius workloads before applying. - Extend the review beyond Edgenius: the kernel flaw affects most major Linux distributions released since 2017\. On Debian-based systems in active support, apply the kernel patch via `sudo apt update && sudo apt upgrade` and reboot. Enumerate other Linux-based OT and edge assets in the estate for the same CVE. P3, within 7 days: - Confirm all Edgenius gateways report version 3.2.4.1 and remove the modprobe workaround if it was applied, to restore the full kernel crypto API. - Add Edgenius gateway patch levels to third-party risk monitoring for ABB, so future PSIRT advisories map automatically to deployed versions. - Review whether any Edgenius node hosts multi-tenant or third-party container workloads; if so, treat those workloads as a live path to step 1 of the chain and constrain them (separate nodes or restricted runtime privileges) until the estate is fully patched. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The sources describe one observable behaviour worth monitoring: successful exploitation ends in a low-privileged local account or container process acquiring root on the node. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------ | | Local user or container process escalates to root on an Edgenius gateway | Audit logs on the gateway node (auditd, auth log); EDR on the host if deployed | High, as the documented outcome of exploitation | | Access to the AF\_ALG cryptographic socket interface followed by privilege change | Kernel audit rules on AF\_ALG socket use; process ancestry showing a non-root parent with a root child | Medium, inferred from the vulnerable interface; no specific telemetry named in the sources | ## 6\. Detection The sources contain no file hashes, distinctive strings, mutexes or command-line artefacts of an exploit. The only concrete, threat-relevant artefacts are the kernel interface name and the workaround's file path, which support behavioural detection of the vulnerable interface being exercised. No YARA rule is possible: there is no malicious file, payload or string set in the source material to build a strings section from, and a rule matching the product name or CVE identifier would detect reporting about the threat rather than the threat itself. A Sigma rule for the researcher-validated workaround is possible and useful for change control, but the sources give no log signature for the exploitation event itself. Rather than emit a rule that invents log fields, we state the limit plainly: the sources provide no process, network or registry telemetry from an actual exploitation attempt. Monitor for use of the AF\_ALG socket family by non-root processes on affected hosts via local audit policy (for example an auditctl rule on the socket domain), and treat any subsequent UID transition to 0 as a high-priority alert. This is a configuration recommendation, not a sourced detection signature. Insufficient indicators to author detection rules. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)** | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | -------- | ---------------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-31431](https://nvd.nist.gov/vuln/detail/CVE-2026-31431?ref=f4n6.co.uk) | 7.8 High | ⚠ KEV 2026-05-01 | 100% | In the Linux kernel, the following vulnerability has been resolved: crypto: algif\_aead - Revert to operating out-of-place Thi… | ## 7\. Sources - CISA, ABB Ability Edgenius (ICSA-26-260-06, revision 2), https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-06, 2026-09-17 - CISA, ABB Ability Edgenius (ICSA-26-195-02, earlier republication of ABB PSIRT 7PAA024620), https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-02, accessed 2026-09-17 - CISA, Impact of Linux Kernel vulnerabilities on B&R products (ICSA-26-174-06), https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-06, accessed 2026-09-17 - ABB PSIRT, ABB CYBERSECURITY ADVISORY 7PAA024620 (PDF and CSAF versions, referenced from the CISA republication), 2026-06-25 (initial version) ## 8\. Adverse Trace position We assess this as a high-severity (CVSS 7.8) local privilege escalation with an unusual combination of factors: KEV-listed with EPSS 100%, publicly disclosed, with public proof-of-concept code reported for the underlying kernel flaw, yet requiring local access to a product that ships with no default low-privilege accounts. For EMEA financial services the direct exposure is narrow, since Edgenius is an OT edge platform rather than core banking infrastructure, but any client running Edgenius gateways at manufacturing-adjacent, energy or facilities sites should treat the 3.2.4.1 update as a 72-hour action, and should widen the review to all Linux hosts on distribution kernels from 2017 onward, which carry the same algif\_aead flaw. The modprobe workaround is single-sourced from the B&R advisory and needs validation on Edgenius before production use; we do not present it as an ABB-endorsed measure. We will track ABB PSIRT 7PAA024620 for revisions, monitor for exploitation reports against Edgenius specifically, and update this advisory if IOCs or exploit artefacts surface. --- [Read the original source →](https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-06?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*