ABB SREA-01 and SREA-50
An attacker may access internal files of the affected products without any authorization over the network, using a HTTP request which refers to files using ../../ relative paths.Once the internal password file is retrieved, the password hash can be identified using a brute force attack. There is also an exploit allowing running of commands after authorization.