ABB Investigates PHP2Shell in Netcontrol and NAM Products
Tech GuruQuick Answer
ABB advisory 2NGA003256 covers specified Netcontrol 100, 200, and 500 gateways and NAM releases. Remove internet exposure, restrict ports 80 and 443, disable the WebGUI or remove NAM's Offline WebGUI container where directed, use SSH for management, monitor systems, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Netcontrol and NAM models, exact builds, WebGUI and lighttpd state, ports 80 and 443, Offline WebGUI containers, management paths, owners, backups, and operational dependencies. Match the exact model and version ranges in ABB's table; do not assume every Netcontrol or NAM deployment is affected or that a disabled web interface proves absence of prior exposure. Remove direct internet access, restrict ports 80 and 443, disable WebGUI or lighttpd as ABB directs, remove the NAM Offline WebGUI container where applicable, and use protected SSH management. Confirm listening services and firewall paths, test supported management and telemetry, review web and process evidence where exposure existed, preserve logs, and document exceptions.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | ABB Netcontrol 100, 200, and 500 gateways and Network Asset Manager |
|---|---|
| Advisory | 2NGA003256 |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Authoritative release date | 2026-10-30 00:30:00 UTC |
| Authority revision date | 2026-10-30 00:30:00 UTC |
| Affected versions | Netcontrol 100 GW102 2.00.0-2.12.034; listed Netcontrol 200 builds through 3.02.050 or A103.03.010; Netcontrol 500 GW502A 6.00.000-7.06.001; and NAM 1.21.00-1.31.000. |
| Fixed version | No fixed version was available while ABB continued its investigation; apply the advisory's WebGUI, port-restriction, and isolation mitigations |
| CVSS base score | 8.1 / 9.8 (CVSS v3.1) |
| CVSS severity | High to Critical |
| Exploitation status | ABB does not state that these vulnerabilities are being maliciously exploited against the listed products.; no exploitation claim is inferred. |
What Changed
ABB is investigating PHP2Shell exposure in the listed Netcontrol and NAM releases and directs customers to disable or remove affected web interfaces where operationally feasible.
What To Validate Now
- Inventory. Inventory Netcontrol and NAM models, exact builds, WebGUI and lighttpd state, ports 80 and 443, Offline WebGUI containers, management paths, owners, backups, and operational dependencies.
- Establish applicability. Match the exact model and version ranges in ABB's table; do not assume every Netcontrol or NAM deployment is affected or that a disabled web interface proves absence of prior exposure.
- Remediate. Remove direct internet access, restrict ports 80 and 443, disable WebGUI or lighttpd as ABB directs, remove the NAM Offline WebGUI container where applicable, and use protected SSH management.
- Validate. Confirm listening services and firewall paths, test supported management and telemetry, review web and process evidence where exposure existed, preserve logs, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
ABB's investigation remains open and no fixed release was listed. Coordinate interface changes with operational owners and continue tracking the authority for a supported update.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
