AVIBIA-2026-0001: Unauthorized access affects AvibiaLine devices

Publisher: AVIBIA GmbH Document category: csaf_security_advisory
Initial release date: 2026-02-02T13:00:00.000Z Engine: Secvisogram 2.5.42
Current release date: 2026-02-02T13:00:00.000Z Build Date: 2026-02-02T10:28:06.686Z
Current version: 1 Status: final
CVSSv3.1 Base Score: 9.8 Severity: High
Original language: Language: en-US
Also referred to: BSI-2026-0001

Summary

An attacker can exploit multiple vulnerabilities AvibiaLine devices to gain unauthorized access or execute a denial of service attack.

Product description

The AvibiaLine devices are a condition monitoring solution for industrial applications

Vulnerabilities

Unauthenticated Access To Device Configuration (CVE-2022-50975)

Vulnerability summary

The ethernet and USB connections are not properly isolated allowing an attacker to configure and reset the device if configuration via ethernet is enabled and there is at least one legitimately authenticated connection active at the time of the attack.

CWE: CWE-346:Origin Validation Error

Product status

Known affected
Product CVSS-Vector CVSS Base Score
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 8.8
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 8.8
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 8.8
Known not affected
Fixed

Remediations

Vendor fix

Update AvibiaLine AVLX devices to firmware version 2.1.1866 or later which includes a fix for this vulnerability.

For products:

https://www.avibia.de/info-center/download/

Restart required: machine

AvibiaLine AVLX devices will be restarted during firmware update.

Unintended Device Reset (CVE-2022-50976)

Vulnerability summary

Resetting the device passwords using an invalid reset file causes a full device reset if the device is connected via USB.

CWE: CWE-1288:Improper Validation of Consistency within Input

Product status

Known affected
Product CVSS-Vector CVSS Base Score
AvibiaLine Configurator 5.0.2416 - 5.0.2486 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:F/RL:O/RC:C 7.7
Fixed

Remediations

Vendor fix

Update AvibiaLine Configurator to version 5.1.2730 or later which includes a fix for this vulnerability.

For products:

https://www.avibia.de/info-center/download/

Unauthenticated Configuration Switch Via HTTP (CVE-2022-50977)

Vulnerability summary

The function to switch between multiple configuration presets via HTTP does not require authentication. An attacker with access to the network could use this functionality to disrupt normal operations if there is more than one configuration preset.

CWE: CWE-306:Missing Authentication for Critical Function

Product status

Known affected
Product CVSS-Vector CVSS Base Score
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
Known not affected

Remediations

No fix planned

Isolate the network from the public internet and limit access to trustworthy devices (see section "Network Security" in the manual).

If only one configuration preset is required remove any other presets.

For products:

Unauthenticated Configuration Switch Via Modbus (TCP) (CVE-2022-50978)

Vulnerability summary

The function to switch between multiple configuration presets via Modbus (TCP) does not require authentication. An attacker with access to the network could use this functionality to disrupt normal operations if there is more than one configuration preset.

CWE: CWE-306:Missing Authentication for Critical Function

Product status

Known affected
Product CVSS-Vector CVSS Base Score
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 7.5
Known not affected

Remediations

No fix planned

Isolate the network from the public internet and limit access to trustworthy devices (see section "Network Security" in the manual).

If only one configuration preset is required remove any other presets.

For products:

Unauthenticated Configuration Switch Via Modbus (RS485) (CVE-2022-50979)

Vulnerability summary

The function to switch between multiple configuration presets via Modbus (RS485) does not require authentication. An attacker with access to the RS485 bus could use this functionality to disrupt normal operations if there is more than one configuration preset.

CWE: CWE-306:Missing Authentication for Critical Function

Product status

Known affected
Product CVSS-Vector CVSS Base Score
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
Known not affected

Remediations

No fix planned

Limit access to the RS485 bus to trustworthy devices.

If only one configuration preset is required remove any other presets.

For products:

Unauthenticated Configuration Switch Via CAN (CVE-2022-50980)

Vulnerability summary

The function to switch between multiple configuration presets via CAN does not require authentication. An attacker with access to the RS485 bus could use this functionality to disrupt normal operations if there is more than one configuration preset.

CWE: CWE-306:Missing Authentication for Critical Function

Product status

Known affected
Product CVSS-Vector CVSS Base Score
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C 6.5
Known not affected

Remediations

No fix planned

Limit access to the CAN bus to trustworthy devices.

If only one configuration preset is required remove any other presets.

For products:

No Password By Default (CVE-2022-50981)

Vulnerability summary

Devices are shipped without a password by default and setting a password is not enforced.

CWE: CWE-521:Weak Password Requirements

Product status

Known affected
Product CVSS-Vector CVSS Base Score
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLE2 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLE4 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLE8 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1340 - 2.1.1387 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLE2 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLE4 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLE8 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX2 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX4 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8
AvibiaLine Firmware 2.1.1866 installed on AvibiaLine AVLX8 HD 5.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C 9.8

Remediations

No fix planned

Assign a password to the device on first use.

For products:

Acknowledgments

AVIBIA GmbH thanks the following parties for their efforts:

AVIBIA GmbH

Namespace: https://www.avibia.de

AVIBIA GmbH Address: Büchlerhausen 22 51766 Engelskirchen Germany E-mail: info(at)avibia.de

AVIBIA GmbH PSIRT is responsible for vulnerability handling across all AVIBIA GmbH products and services.

References

Revision history

Version Date of the revision Summary of the revision
1 2026-02-02T13:00:00.000Z Initial publication

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/

Legal Disclaimer

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. AVIBIA GMBH RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Terms of Use

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to AVIBIA GmbH and provide a link to the original.