Netcontrol 100, 200, 500, GW502-iM, NAM PHP2Shell Critical Vulnerabilities

The problem is corrected in the following software release packages published for products: - Netcon 200 (GWDD-A03): Software release A103.03.020 published Nov-2-2026 ABB recommends that customers apply the update at earliest convenience. The process to install updates and identify the installed product version is described in the user manual and release note document attached to installation package. For Netcon 100, Netcon 200, Netcon 500, Netcon GW502-iM using affected WebGUI service: 1. Make sure that any RTU could not be accessible directly from Internet. 2. Restrict any network access to ports 80/443 of RTU devices. 3. If the WebGUI needs to be accessible, use a dedicated host for it and allow access only from a specific IP address and secure VPN tunnel. 4. Further action to prevent vulnerability to be exploited is to disable lighttpd service using SSH interface. Please note that without WebGUI interface, device configuration will be limited to Linux environment. Deactivation can… For Netcon Application Manager using affected Offline WebGUI service: 1. Make sure that Netcon Application Manager cannot be accessible directly from Internet. 2. Disable or remove Offline WebGUI containers. If more information is needed, please follow the manual. Refer to section General security recommendations for further advice on how to keep your system secure.