Oil and Gas Weak Spot: ABB TotalFlow Computers

Team82 discovered and disclosed a high-severity path-traversal vulnerability (CVE-2022-0902, CWE-22, CVSS 8.1) in ABB TotalFlow flow computers and controllers that allows attackers to read/write arbitrary files and achieve remote code execution as root. The report documents reverse engineering of the TotalFlow protocol, an authentication bypass via CRC-16-protected 4-digit passcodes, a proof-of-concept exploit (reading /etc/shadow, enabling SSH), affected product models, and mitigation steps including a firmware update and network segmentation.