The vulnerability is a missing authentication for a critical function in ABB AWIN GW100 rev.2 and GW120 devices. This flaw allows an attacker to access or modify configuration data without authenticating, potentially leading to unauthorized configuration changes and compromising the device’s integrity and availability. The weakness is classified as CWE-306.

Affected vendors and products are ABB: AWIN GW100 rev.2 and ABB: AWIN GW120. The specific firmware versions vulnerable are AWIN GW100 rev.2: 2.0-0 and 2.0-1; AWIN GW120: 1.2-0 and 1.2-1. No other versions are listed as affected.

The CVSS score of 7.2 indicates a high severity risk. The EPSS score is less than 1%, suggesting a low probability of exploitation currently, and the vulnerability is not included in the CISA KEV catalog. The likely attack vector is network‑based: an attacker with network access can send unauthenticated requests to the device’s critical function, leading to configuration data exposure. This can be achieved without additional prerequisites.