The vulnerability is a missing authentication requirement for a critical device reboot function in ABB AWIN GW100 rev.2 and AWIN GW120. Without proper authentication, an attacker can trigger an immediate reboot of the device. This leads to a denial of service and could disrupt any processes or operations the device is performing. The weakness corresponds to CWE-306: Authentication Bypass Through ID or Password.

Affected vendors and products are ABB AWIN GW100 rev.2 with firmware versions 2.0-0 and 2.0-1, and ABB AWIN GW120 with firmware versions 1.2-0 and 1.2-1.

The CVSS score is 7.1, indicating a high impact vulnerability. EPSS is less than 1%, suggesting low current exploitation probability, and it is not listed in the CISA KEV catalog. Based on the lack of authentication for the reboot function, the likely attack vector is remote network access or local interface use if an attacker can reach the device. As the vulnerability description does not specify the exact attack path, this inference is based on the nature of the missing authentication and common exploitation techniques for device reboot controls.