Description Summary:
A privilege escalation vulnerability in AGL app-framework-binder (afb-daemon) allows local attackers to execute arbitrary APIs with null credentials.

Executive Summary:
A privilege escalation vulnerability in the AGL app-framework-binder affects multiple ABB products up to version 19.90.0, allowing local users to bypass security controls and execute arbitrary APIs with null credentials.

Vulnerability Details

CVE-ID: CVE-2026-37525

Affected Software: ABB Multiple Products (AGL app-framework-binder)

Affected Versions: Through v19.90.0

Vulnerability: This privilege escalation flaw involves improper credential handling within the supervision Do command in src/afb-supervision.c, where low-privileged local attackers can trigger arbitrary API calls with null credentials, enabling them to bypass authorization checks.

Business Impact

A successful exploit allows a local attacker to escalate privileges and execute authorized API calls that fail open when receiving null credentials. This compromises the integrity and confidentiality of the underlying automotive or embedded system, potentially leading to unauthorized control functions or data access. The CVSS score of 7.8 indicates high severity, reflecting substantial potential impact on system security despite requiring low privileges.

Remediation Plan

Immediate Action: Apply vendor security updates immediately as provided by ABB or the Automotive Grade Linux project.

Proactive Monitoring: Monitor system logs for anomalous API execution patterns and unexpected supervisor command invocations.

Compensating Controls: Restrict local user access and shell privileges on the affected device to minimize the likelihood of an attacker establishing local execution capability.

Exploitation Status

Public Exploit Available: No — no confirmed public exploit is currently tracked in our primary data sources.

Analyst Notes: As of May 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability requires local access with low privileges to interact with the daemon interface.

Analyst Recommendation

Given the high severity and potential for total technical impact on affected systems, administrators must prioritize applying vendor patches as soon as they become available. Restricting local access provides a critical layer of defense while awaiting remediation.

Description Summary:
A vulnerability exists in ABB MConfig where sensitive information is stored in cleartext within system memory, potentially allowing unauthorized access or modification.

Executive Summary:
A memory-based cleartext storage vulnerability in ABB MConfig presents a high risk of sensitive data exposure and system integrity compromise.

Vulnerability Details

CVE-ID: CVE-2025-9970

Affected Software: ABB MConfig

Affected Versions: 0 through 1.4.9.21

Vulnerability: This vulnerability involves the insecure storage of sensitive information in memory, classified under CWE-316. An attacker with local access, combined with specific environmental conditions (as indicated by the CVSS vector), could potentially leverage this flaw to compromise the integrity of the application.

Business Impact

The exploitation of this vulnerability could lead to the unauthorized disclosure or manipulation of sensitive data residing in memory. With a CVSS score of 7.4, this issue is considered high severity, as it poses a significant risk to the confidentiality and integrity of industrial configuration processes managed by MConfig. Organizations relying on this software for critical infrastructure may face operational disruptions or data security incidents if this flaw is successfully targeted.

Remediation Plan

Immediate Action: Review the official ABB security advisory (Document ID 4TZ00000006008) to identify available patches or security configuration hardening steps for MConfig.

Proactive Monitoring: Monitor system logs for unauthorized access patterns or suspicious local process activity that might indicate an attempt to inspect application memory.

Compensating Controls: Restrict local access to the systems running MConfig to only authorized personnel and utilize endpoint security solutions to monitor for memory dumping or unauthorized debugging activities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of October 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The complexity of the attack vector, requiring local access and specific conditions, makes widespread automated exploitation unlikely at this time.

Analyst Recommendation

Given the high CVSS severity, administrators should prioritize the assessment of their MConfig deployments to determine exposure. While no public exploit exists, the nature of memory-based vulnerabilities necessitates strict adherence to the principle of least privilege for local system access. Ensure that all systems are updated as soon as official vendor guidance or patches become available to mitigate the risk of local data compromise.

Description Summary:
A missing authentication flaw in ABB ALS-mini-s4 IP and ALS-mini-s8 IP devices allows unauthenticated attackers to perform unauthorized critical functions.

Executive Summary:
A critical authentication bypass vulnerability in specific ABB IP hardware allows unauthenticated attackers to execute unauthorized commands, posing a severe risk to operational security.

Vulnerability Details

CVE-ID: CVE-2025-9574

Affected Software: ABB ALS-mini-s4 IP and ALS-mini-s8 IP

Affected Versions: All firmware versions with Serial Numbers from 2000 to 5166

Vulnerability: The vulnerability is identified as a Missing Authentication for Critical Function (CWE-306), which permits an unauthenticated, network-adjacent attacker to perform sensitive operations without providing valid credentials.

Business Impact

The ability for an unauthenticated user to access critical functions presents a severe risk of unauthorized configuration changes or operational disruption. With a CVSS score of 9.1, this vulnerability is classified as critical, as it could lead to total loss of control over the affected industrial hardware. Such compromises may result in significant downtime and potential safety risks within the environments where these devices are deployed.

Remediation Plan

Immediate Action: Consult the official ABB security advisory (Document ID 4TZ00000006007) to determine if a firmware update or hardware replacement is required for units within the affected serial number range.

Proactive Monitoring: Inspect network traffic logs for unauthorized access attempts directed at the management interfaces of the affected ABB devices.

Compensating Controls: Restrict network access to the management interfaces of these devices to trusted management subnets only using hardware firewalls or VLAN isolation.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of October 20, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The lack of authentication requirements makes this device highly susceptible to automated exploitation attempts if reachable over the network.

Analyst Recommendation

Given the critical CVSS severity score of 9.1 and the lack of authentication, immediate isolation of these devices from public or untrusted networks is mandatory. Administrators must review the serial numbers of their installed base against the affected range and coordinate with ABB support to apply the necessary security updates or remediations as soon as they become available.

Description Summary:
A missing authentication vulnerability exists in ABB Ability zenon, which allows unauthenticated attackers to trigger critical functions.

Executive Summary:
A critical missing authentication vulnerability in ABB Ability zenon exposes the software to unauthorized access and potential service disruption by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2025-8754

Affected Software: ABB Ability zenon

Affected Versions: 7.50 through 14

Vulnerability: This vulnerability is classified as CWE-306, where the application fails to verify the identity of a user before executing sensitive operations. The CVSS vector confirms that this flaw is exploitable over the network by an unauthenticated attacker with no user interaction required.

Business Impact

The ability for an unauthenticated actor to interact with critical functions poses a significant risk to operational integrity and system availability. With a CVSS score of 7.5, this high-severity vulnerability could lead to unauthorized system state changes or denial of service, potentially resulting in operational downtime or the compromise of industrial control environments.

Remediation Plan

Immediate Action: Review the official ABB security advisory (Document ID 2NGA002743) to identify available patches or configuration changes and apply them to all affected instances immediately.

Proactive Monitoring: Monitor system access logs for unusual administrative activity or unauthorized attempts to reach critical internal endpoints.

Compensating Controls: Implement strict network segmentation and utilize firewalls to restrict access to the zenon interface, ensuring only authorized management stations can communicate with the service.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 14, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no exploit is currently documented, the lack of authentication for critical functions makes this a high-risk target for automated scanning and exploitation.

Analyst Recommendation

Given the potential for unauthenticated remote exploitation, organizations running ABB Ability zenon should prioritize identifying affected versions within their environment. Administrative teams must transition from reliance on perimeter security to hardening the application itself by applying the vendor-supplied updates or implementing the specific mitigations detailed in the ABB security bulletin.

Description Summary:
The ABB ASPECT system contains a missing authentication vulnerability that allows unauthenticated users to bypass security controls and access critical functions.

Executive Summary:
A critical authentication bypass vulnerability in the ABB ASPECT system allows unauthenticated attackers to gain unauthorized access to critical functions, posing a severe risk to operational integrity.

Vulnerability Details

CVE-ID: CVE-2025-7679

Affected Software: ABB ASPECT

Affected Versions: All versions

Vulnerability: This vulnerability involves a missing authentication for a critical function (CWE-306). It allows an unauthenticated attacker to interact with sensitive system processes without providing valid credentials.

Business Impact

The ability for an unauthenticated user to bypass authentication mechanisms creates a significant risk of unauthorized command execution and system compromise. Given the CVSS score of 7.4, this vulnerability represents a high-severity threat that could lead to full control over affected ASPECT systems, potentially resulting in operational disruption or the manipulation of industrial control processes.

Remediation Plan

Immediate Action: Review the official ABB security advisory provided in the reference link and apply all available security updates or configuration changes recommended by the vendor.

Proactive Monitoring: Monitor network access logs for anomalous traffic directed at the ASPECT system and implement strict network segmentation to limit exposure to untrusted networks.

Compensating Controls: Deploy a Web Application Firewall or industrial-grade firewall to filter traffic and restrict unauthorized access to the affected management interfaces until the system can be fully patched.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known exploit reduces immediate urgency, the nature of the flaw, which allows unauthenticated access to critical functions, makes it a high-priority target for threat actors.

Analyst Recommendation

Given the critical nature of authentication bypass vulnerabilities in industrial systems, organizations must treat this flaw with high urgency. Administrators should verify their current version of ABB ASPECT against the vendor's updated guidance and ensure that the system is isolated from public internet access wherever possible to prevent exploitation.

Description Summary:
A stack-based buffer overflow exists in the ABB RMC-100 and RMC-100 LITE REST interface, which may allow an attacker to cause a denial of service.

Executive Summary:
A stack-based buffer overflow vulnerability in the ABB RMC-100 and RMC-100 LITE series poses a significant risk to industrial control network availability.

Vulnerability Details

CVE-ID: CVE-2025-6073

Affected Software: ABB RMC-100 and RMC-100 LITE

Affected Versions: RMC-100: 2105457-043 through 2105457-045; RMC-100 LITE: 2106229-015 through 2106229-016

Vulnerability: The vulnerability is a stack-based buffer overflow (CWE-121) occurring within the REST interface. Successful exploitation requires the interface to be enabled, user authentication to be active, and the prior exploitation of CVE-2025-6074 to bypass initial controls.

Business Impact

The vulnerability carries a CVSS score of 7.5, indicating a high severity level primarily due to the potential for service disruption. In an industrial environment, the unexpected crash of a control device can lead to unplanned downtime, loss of operational visibility, and potential safety risks if the device is managing critical processes.

Remediation Plan

Immediate Action: Monitor the official ABB security advisory portal for the release of firmware updates and apply them to all affected RMC-100 and RMC-100 LITE units as soon as they become available.

Proactive Monitoring: Review system logs for unauthorized access attempts to the REST interface and monitor for unusual traffic patterns targeting control network communication ports.

Compensating Controls: Restrict network access to the REST interface by implementing strict firewall rules that limit communication to authorized management stations only.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 7, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for a multi-stage attack involving a separate vulnerability (CVE-2025-6074) increases the complexity of exploitation, but the potential for system instability remains a critical concern for ICS operators.

Analyst Recommendation

Given the potential for service disruption in industrial control environments, operators should treat this vulnerability with high priority. We recommend isolating affected devices from public or untrusted network segments until official patches are applied and verified.

Description Summary:
A stack-based buffer overflow exists in the REST interface of ABB RMC-100 and RMC-100 LITE devices, allowing potential service disruption when chained with CVE-2025-6074.

Executive Summary:
A stack-based buffer overflow vulnerability in ABB RMC-100 series devices poses a significant risk to system availability if the device REST interface is exposed and chained with other vulnerabilities.

Vulnerability Details

CVE-ID: CVE-2025-6072

Affected Software: ABB RMC-100 and RMC-100 LITE

Affected Versions: RMC-100: 2105457-043 through 2105457-045; RMC-100 LITE: 2106229-015 through 2106229-016

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the REST interface of the affected controllers. An attacker can trigger this condition by supplying a malicious JSON configuration to the expiration date field, provided they have already successfully exploited CVE-2025-6074 and gained network access.

Business Impact

Successful exploitation of this vulnerability leads to a high impact on system availability, potentially causing device crashes or denial of service in industrial control environments. With a CVSS score of 7.5, this is classified as a high-severity issue, primarily due to the potential for service disruption, which could halt critical operational processes.

Remediation Plan

Immediate Action: Consult the official ABB security advisory (DocumentID 9AKK108471A3623) to determine if a firmware update is available for your specific hardware revision and apply it immediately.

Proactive Monitoring: Monitor network traffic for unusual REST interface activity and audit device logs for signs of configuration tampering or unexpected service restarts.

Compensating Controls: Restrict network access to the REST interface to authorized personnel only, and implement strict firewall rules to ensure only trusted segments can communicate with these control devices.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 7, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires a complex attack chain involving a secondary vulnerability, which limits the immediate threat landscape to environments where both conditions are met.

Analyst Recommendation

Given the potential for denial of service on critical industrial hardware, administrators should prioritize evaluating their exposure to this flaw. Ensure that the REST interface is disabled unless strictly required for operations, and follow the official ABB guidance to secure these controllers against this buffer overflow risk.

Description Summary:
A vulnerability exists in ABB Aspect that may allow for unauthorized system interaction. The specific nature of the flaw is currently under investigation by the vendor.

Executive Summary:
A vulnerability identified in ABB Aspect presents a high security risk that necessitates immediate attention from administrators to prevent potential unauthorized access.

Vulnerability Details

CVE-ID: CVE-2025-53190

Affected Software: ABB Aspect

Affected Versions: See vendor advisory

Vulnerability: The vulnerability involves an unspecified flaw within the ABB Aspect software suite. Due to the limited technical details currently available, the specific impact on authentication requirements and the vulnerable code path remain undefined.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized system access or potential service disruption within industrial control environments. With a CVSS score of 7.0, this issue is classified as High severity, indicating that the potential for significant operational impact is substantial if left unaddressed.

Remediation Plan

Immediate Action: Administrators must consult the official ABB security advisory to identify the specific affected versions and apply the recommended security updates as soon as they become available.

Proactive Monitoring: Security teams should monitor system access logs for anomalous activity or unauthorized connection attempts targeting ABB Aspect instances.

Compensating Controls: Implement strict network segmentation and ensure that access to the affected software is restricted to authorized personnel only to limit the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of detailed disclosure suggests that organizations should prioritize monitoring vendor communications for further technical specifics.

Analyst Recommendation

Given the High severity rating associated with this vulnerability, it is imperative to maintain a state of heightened vigilance. Security administrators should prioritize the review of vendor-supplied documentation and prepare to deploy patches immediately upon their release to ensure the continued integrity and availability of the affected systems.

Description Summary:
An authentication bypass vulnerability in ABB ASPECT allows unauthenticated attackers to execute unauthorized commands, modify system time, and access restricted files.

Executive Summary:
A critical authentication bypass flaw in ABB ASPECT permits unauthenticated remote attackers to gain full system control and access sensitive configuration data.

Vulnerability Details

CVE-ID: CVE-2025-53187

Affected Software: ABB ASPECT

Affected Versions: All versions prior to 3.08.04-s01

Vulnerability: The software contains debug code in the production release that permits an unauthenticated attacker to bypass authentication mechanisms. This flaw allows unauthorized parties to manipulate system time, access files, and invoke restricted function calls.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational operations, as it grants unauthorized actors total access to the affected system. Given the CVSS score of 7.0, the impact on confidentiality, integrity, and availability is significant, potentially leading to unauthorized system control and the compromise of critical industrial or building management data.

Remediation Plan

Immediate Action: Upgrade the ABB ASPECT firmware to version 3.08.04-s01 or higher immediately to remove the vulnerable debug code.

Proactive Monitoring: Monitor network traffic and system access logs for anomalous requests, particularly those attempting to invoke internal function calls or access system files from unauthorized sources.

Compensating Controls: Implement strict network segmentation to restrict access to the ASPECT interface to authorized management subnets only, and utilize a Web Application Firewall to block suspicious traffic patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of leftover debug code in a production environment represents a significant security oversight that requires immediate patching to prevent potential exploitation.

Analyst Recommendation

The severity of this vulnerability, combined with the ease of exploitation via the unauthenticated bypass, necessitates immediate action. Administrators must prioritize the deployment of the vendor-provided firmware update to eliminate the unauthorized access path and secure the environment against potential compromise.

Description Summary:
An incorrect implementation of the authentication algorithm in ABB WebPro SNMP Cards allows for potential security bypasses.

Executive Summary:
A critical authentication vulnerability in ABB WebPro SNMP cards exposes affected power management systems to unauthorized control and potential service disruption.

Vulnerability Details

CVE-ID: CVE-2025-4676

Affected Software: ABB WebPro SNMP Card

Affected Versions: ABB WebPro SNMP Card PowerValue: 0 through 1.1.8.k; ABB WebPro SNMP Card PowerValue UL: 0 through 1.1.8.k

Vulnerability: The device suffers from an incorrect implementation of the authentication algorithm, classified under CWE-303. This flaw allows an unauthenticated attacker, positioned on the adjacent network, to bypass security controls and achieve a high impact on system integrity and availability.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high level of severity due to the potential for total impact on system availability and integrity. Successful exploitation could allow attackers to manipulate power management settings, leading to unauthorized system shutdowns or the disruption of critical infrastructure services, which may result in significant operational downtime and reputational damage.

Remediation Plan

Immediate Action: Review the official ABB security advisory and apply the latest firmware updates as soon as they are released by the vendor.

Proactive Monitoring: Monitor network traffic directed toward SNMP management interfaces for anomalous patterns and review system access logs for unauthorized authentication attempts.

Compensating Controls: Restrict access to the SNMP management interface by implementing strict network segmentation and firewall rules that limit communication to authorized management workstations only.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of January 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the complexity of the authentication flaw makes it a high-priority target for threat actors seeking to disrupt industrial control environments.

Analyst Recommendation

Given the high severity of this vulnerability and its potential to impact physical power management systems, administrators should treat this as a priority update. Organizations must restrict network access to affected SNMP cards immediately while awaiting specific patch deployment instructions from ABB to mitigate the risk of unauthorized access.

Description Summary:
ABB CoreSense HM and M10 devices are affected by a path traversal vulnerability that allows unauthorized file access.

Executive Summary:
A path traversal vulnerability in ABB CoreSense HM and M10 devices enables unauthorized file access, posing a significant risk to industrial control system integrity.

Vulnerability Details

CVE-ID: CVE-2025-3465

Affected Software: ABB CoreSense HM and CoreSense M10

Affected Versions: CoreSense HM: 0 through 2.3.1; CoreSense M10: 0 through 1.4.1.12

Vulnerability: This is a path traversal vulnerability (CWE-22) residing in the affected ABB products, which allows an unauthenticated attacker to bypass directory restrictions and access sensitive files on the host system.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to sensitive system files, which could lead to information disclosure or further compromise of the industrial environment. With a CVSS score of 7.1, this flaw represents a high-severity risk, particularly in operational technology environments where system availability and data confidentiality are critical to business continuity.

Remediation Plan

Immediate Action: Update ABB CoreSense HM to version 2.3.4 and CoreSense M10 to version 1.4.1.31 immediately.

Proactive Monitoring: Monitor network traffic and system access logs for anomalous file path requests or unauthorized attempts to access directories outside of the intended application scope.

Compensating Controls: Implement strict network segmentation to isolate these devices from external networks and utilize industrial firewalls to restrict traffic to known and authorized communication paths.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of October 21, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The path traversal nature of the flaw makes it inherently dangerous, as it often serves as a prerequisite for more complex attack chains.

Analyst Recommendation

Given the high CVSS severity and the critical nature of the affected industrial hardware, administrators must prioritize the application of the vendor-provided security patches. Ensure that all affected devices are upgraded to the specified versions to eliminate the path traversal risk, and conduct a review of system logs to ensure no prior unauthorized access has occurred.

Description Summary:
The ABB T-MAC Plus system contains an authorization bypass vulnerability caused by improper handling of user-controlled keys.

Executive Summary:
An authorization bypass vulnerability in the ABB T-MAC Plus system allows unauthorized users to gain elevated access, potentially leading to unauthorized control of industrial processes.

Vulnerability Details

CVE-ID: CVE-2025-14772

Affected Software: ABB T-MAC Plus

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability stems from the system's reliance on user-controlled keys for authorization decisions. An attacker can manipulate these keys to bypass authentication or authorization checks, gaining access to restricted functions or data without proper credentials.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to operational technology (OT) environments. Successful exploitation could lead to unauthorized modification of industrial process parameters, system instability, or the bypass of critical safety controls, potentially resulting in operational downtime or physical safety incidents.

Remediation Plan

Immediate Action: Apply the vendor-provided security update or patch to the T-MAC Plus system to correct the authorization logic.

Proactive Monitoring: Monitor access control logs for unusual activity, specifically for users attempting to access modules or settings outside of their assigned permissions.

Compensating Controls: Implement strict network segmentation to isolate the T-MAC Plus system from untrusted networks and enforce multi-factor authentication (MFA) where supported.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of industrial control systems, this authorization bypass must be addressed as a top priority. Administrators should apply the necessary patches and review all access control configurations to ensure that only authorized personnel have access to sensitive system functions.

Description Summary:
A vulnerability in ABB T-MAC Plus allows unauthorized external parties to access restricted files or directories.

Executive Summary:
A critical vulnerability in ABB T-MAC Plus allows unauthorized external parties to access restricted files and directories, posing a severe threat to system confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-14771

Affected Software: ABB T-MAC Plus

Affected Versions: ABB T-MAC Plus: 4.0-24.

Vulnerability: The vulnerability involves improper access control, where files or directories within the application are accessible to external parties. This allows an unauthorized attacker to view or potentially manipulate sensitive data stored within the T-MAC Plus environment.

Business Impact

The CVSS score of 9.9 indicates a severe risk to information confidentiality. Unauthorized access to system files can expose sensitive configurations, credentials, or operational data, potentially leading to further exploitation or significant operational disruption within industrial or enterprise environments.

Remediation Plan

Immediate Action: Update ABB T-MAC Plus to version 4.0-25 or later as specified in the vendor advisory.

Proactive Monitoring: Audit access logs for unauthorized attempts to access system files and monitor for unusual data egress patterns.

Compensating Controls: Implement file-system level permissions to restrict access to sensitive directories and ensure the application is running with the principle of least privilege.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jun 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations utilizing ABB T-MAC Plus must prioritize the update to version 4.0-25. Addressing this access control issue is essential to prevent unauthorized disclosure of sensitive system information and to maintain the overall security of the industrial environment.

Description Summary:
An incorrect implementation of the authentication algorithm in ABB Ability OPTIMAX allows for potential authentication bypass or compromise.

Executive Summary:
A critical authentication flaw in ABB Ability OPTIMAX exposes systems to unauthorized access and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2025-14510

Affected Software: ABB Ability OPTIMAX

Affected Versions: 6.1, 6.2, 6.3.0 before 6.3.1-251120, 6.4.0 before 6.4.1-251120

Vulnerability: This vulnerability involves an incorrect implementation of the authentication algorithm (CWE-303). Based on the CVSS vector, the vulnerability is reachable over the network without user interaction, though it requires specific attack conditions.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high level of risk to operational technology environments. Successful exploitation allows an attacker to bypass authentication, which could lead to unauthorized control over critical industrial processes, potential data loss, or significant system downtime.

Remediation Plan

Immediate Action: Update ABB Ability OPTIMAX to version 6.3.1-251120 or 6.4.1-251120 as specified in the official vendor advisory.

Proactive Monitoring: Review system access logs for unusual authentication patterns or unauthorized attempts to access administrative functions.

Compensating Controls: Restrict network access to the affected OPTIMAX instances using firewalls or network segmentation to ensure only authorized traffic can reach the application layer.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of January 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on specific environmental conditions for successful exploitation provides a limited window for defensive patching before active threats emerge.

Analyst Recommendation

Given the potential for high-impact compromise within industrial control systems, administrators must prioritize this update. Organizations should verify their current deployment versions immediately and schedule maintenance windows to apply the necessary patches to mitigate the risk of unauthorized access.

Description Summary:
A missing authentication flaw in ABB AWIN GW100 and GW120 gateways allows unauthenticated remote attackers to interact with critical functions.

Executive Summary:
A critical authentication bypass vulnerability in ABB AWIN gateway devices exposes affected systems to unauthorized control and potential service disruption.

Vulnerability Details

CVE-ID: CVE-2025-13779

Affected Software: ABB AWIN GW100 and GW120

Affected Versions: AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1

Vulnerability: The vulnerability, classified as CWE-306, involves the absence of necessary authentication checks for critical functions. An unauthenticated attacker positioned on the local network can invoke sensitive operations without providing valid credentials.

Business Impact

The CVSS score of 8.3 indicates a High severity risk, reflecting the potential for unauthorized access to industrial gateway functions. Successful exploitation could lead to loss of control over industrial processes, unauthorized configuration changes, or significant operational downtime, posing a direct threat to business continuity and safety.

Remediation Plan

Immediate Action: Consult the official ABB security advisory (Document ID 4JNO000329) to verify if a firmware patch has been released and apply it immediately. If no patch is available, restrict network access to the management interfaces of these devices to trusted management segments only.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at the management ports of the affected AWIN gateways. Review device logs for unusual administrative activity or unauthorized command execution.

Compensating Controls: Implement strict network segmentation and firewall rules to ensure that the gateway management interfaces are not exposed to untrusted network segments. Use an internal VPN or jump host to mediate access to the management console.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires local network access, the lack of authentication makes this an attractive target for internal threats or attackers who have already established a foothold in the local network.

Analyst Recommendation

Given the High severity and the critical nature of these industrial gateways, immediate action is required to harden the network perimeter surrounding these assets. Organizations should verify their current firmware version against the ABB advisory and prioritize the application of any available security updates to mitigate the risk of unauthorized command execution.

Description Summary:
An authentication bypass vulnerability exists in ABB AWIN gateway devices due to a capture-replay flaw, allowing unauthenticated attackers to potentially disrupt services.

Executive Summary:
A critical authentication bypass vulnerability in ABB AWIN gateway devices allows unauthenticated attackers to intercept and replay credentials, posing a significant risk to industrial control systems.

Vulnerability Details

CVE-ID: CVE-2025-13777

Affected Software: ABB AWIN GW100 and AWIN GW120

Affected Versions: AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1

Vulnerability: This vulnerability is identified as a capture-replay flaw (CWE-294), where an unauthenticated attacker can capture valid authentication traffic and replay it to gain unauthorized access to the gateway.

Business Impact

The exploitation of this vulnerability could lead to significant operational disruption, as the attacker gains unauthorized control over the affected industrial gateway. Given the CVSS score of 8.3, this represents a high-severity risk that could result in loss of availability or unauthorized configuration changes within the production environment.

Remediation Plan

Immediate Action: Review the official ABB security advisory for available firmware updates or configuration hardening steps to mitigate the replay attack vector.

Proactive Monitoring: Monitor network traffic for unusual authentication patterns or repeated connection attempts originating from the same source to the gateway management interface.

Compensating Controls: Implement strict network segmentation to ensure that the gateway management interfaces are not exposed to untrusted network segments, thereby limiting the attacker's ability to capture traffic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of replay protection in the authentication mechanism, which permits unauthorized access without requiring knowledge of the actual credentials.

Analyst Recommendation

This vulnerability presents a high risk to availability and control integrity for the affected ABB hardware. Organizations should prioritize identifying all instances of the impacted models within their infrastructure and apply vendor-provided updates immediately upon release. Until patches are applied, ensure that access to these devices is strictly restricted to authorized management subnets to minimize exposure.

Description Summary:
ABB Ability Edgenius contains an authentication bypass vulnerability due to an alternate path or channel, potentially allowing unauthorized access to the system.

Executive Summary:
A critical authentication bypass vulnerability in ABB Ability Edgenius 3.2.0.0 and 3.2.1.1 could allow an unauthenticated attacker to gain full control over the affected system.

Vulnerability Details

CVE-ID: CVE-2025-10571

Affected Software: ABB Ability Edgenius

Affected Versions: 3.2.0.0, 3.2.1.1

Vulnerability: This is an authentication bypass vulnerability (CWE-288) triggered by an alternate path or channel, requiring no authentication from the attacker to successfully exploit.

Business Impact

The vulnerability carries a CVSS score of 9.6, reflecting the potential for complete compromise of system integrity, availability, and confidentiality. Successful exploitation could lead to unauthorized administrative control over industrial management systems, posing significant operational risks, potential safety hazards, and severe reputational damage to the organization.

Remediation Plan

Immediate Action: Upgrade ABB Ability Edgenius to version 3.2.2.0 or later as soon as possible. If an immediate upgrade is not feasible, disable the Edgenius Management Portal to eliminate the attack vector.

Proactive Monitoring: Monitor network access logs for unusual traffic patterns targeting the Edgenius Management Portal or unauthorized attempts to access management interfaces.

Compensating Controls: Implement strict network segmentation to restrict access to the Edgenius management interface to authorized personnel only, and deploy Web Application Firewalls (WAF) to inspect and block suspicious incoming requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Nov 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given the critical nature of the flaw and the potential for full system compromise, the lack of active exploitation evidence does not reduce the necessity for prompt patching.

Analyst Recommendation

Due to the critical severity and the potential for total system compromise, organizations running the affected versions of ABB Ability Edgenius must prioritize this update. Apply the 3.2.2.0 patch immediately or disable the vulnerable portal to prevent unauthorized access. Failure to address this vulnerability poses an unacceptable risk to industrial control environments.

Description Summary:
ABB FLXEON is susceptible to an improper input validation vulnerability that may lead to significant security compromise.

Executive Summary:
The ABB FLXEON product is affected by an input validation vulnerability that could allow an authenticated attacker with high privileges to cause a total impact on system integrity, confidentiality, and availability.

Vulnerability Details

CVE-ID: CVE-2025-10207

Affected Software: ABB FLXEON

Affected Versions: 0 through 9.3.5

Vulnerability: This vulnerability, classified as CWE-1287, involves the improper validation of specified input types within the FLXEON software. The vulnerability requires the attacker to possess high privileges (PR:H) to successfully exploit the flaw.

Business Impact

The exploitation of this vulnerability poses a severe risk to operational continuity, as it allows for a total impact on the affected system. Given the CVSS score of 7.2, this vulnerability is categorized as High severity, indicating that successful exploitation could result in unauthorized data access or disruption of critical business processes. Organizations relying on FLXEON for industrial or infrastructure management must prioritize this risk to prevent potential service degradation or unauthorized control.

Remediation Plan

Immediate Action: Consult the official ABB security advisory to identify and apply the necessary firmware or software updates as soon as they become available.

Proactive Monitoring: Monitor system access logs for any unauthorized configuration changes or anomalous activity originating from high-privilege user accounts.

Compensating Controls: Implement strict network segmentation and restrict administrative access to the management interfaces to minimize the attack surface until a patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires high privileges, the total impact on system resources warrants immediate attention once a vendor patch is released.

Analyst Recommendation

The severity of this flaw requires diligent monitoring of the ABB security portal for the release of a definitive patch. Security teams should ensure that access control lists are hardened to prevent unauthorized high-privilege access, which is a prerequisite for exploiting this vulnerability. Immediate remediation is required upon the release of vendor updates to mitigate the risk of total system compromise.

Description Summary:
ABB FLXEON is susceptible to a vulnerability involving the use of a one-way hash with a predictable salt, potentially compromising credential integrity.

Executive Summary:
A critical security vulnerability in ABB FLXEON allows for the use of predictable salts in cryptographic hashing, which could facilitate unauthorized credential access.

Vulnerability Details

CVE-ID: CVE-2025-10205

Affected Software: ABB FLXEON

Affected Versions: 0 through 9.3.5

Vulnerability: This vulnerability involves the use of a one-way hash with a predictable salt (CWE-759). The vulnerability is unauthenticated (AV:A/PR:N/UI:N), meaning an attacker with adjacent network access can potentially exploit the predictable salt to perform brute-force or dictionary attacks against stored credentials.

Business Impact

The use of predictable salts significantly reduces the computational effort required to reverse password hashes. Successful exploitation could lead to unauthorized access to the FLXEON system, resulting in a complete loss of confidentiality and integrity for user credentials, potentially leading to broader system compromise or unauthorized control. Given the CVSS 8.8 score, this represents a high-severity risk that demands immediate attention to prevent credential harvesting.

Remediation Plan

Immediate Action: Review the provided ABB security advisory (Document ID 9AKK108471A7121) to determine if a patch or configuration workaround is available for your specific deployment version.

Proactive Monitoring: Monitor network traffic for unusual authentication patterns and review system logs for repeated failed login attempts or unauthorized access requests.

Compensating Controls: Ensure that the FLXEON system is isolated within a secure network segment to restrict adjacent network access, thereby limiting the pool of potential attackers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires adjacent network access, the underlying flaw is inherently dangerous because it undermines the fundamental security of the system authentication mechanism.

Analyst Recommendation

The vulnerability in ABB FLXEON represents a significant risk to credential security due to the predictable nature of the cryptographic salt implementation. Administrators should prioritize reviewing the official ABB documentation to identify if an update is available and implement network-level isolation to mitigate the risk of unauthorized access from adjacent network segments until a permanent resolution can be applied.

Description Summary:
ABB FLXEON is susceptible to improper input validation, which can lead to remote code execution by a privileged attacker.

Executive Summary:
An improper input validation vulnerability in ABB FLXEON allows an authenticated remote attacker to achieve remote code execution on the affected system.

Vulnerability Details

CVE-ID: CVE-2024-48851

Affected Software: ABB FLXEON

Affected Versions: 0 through 9.3.5

Vulnerability: This vulnerability, identified as CWE-1287, involves improper validation of input types within the FLXEON software. The vulnerability requires high privileges (PR:H) to exploit, allowing an authenticated user to trigger remote code execution.

Business Impact

The ability to execute arbitrary code remotely poses a severe risk to operational integrity, potentially allowing an attacker to gain full control over the affected ABB FLXEON system. With a CVSS score of 7.2, this vulnerability is classified as High severity, indicating a significant threat to system confidentiality, integrity, and availability. Compromise of such industrial control components can lead to unauthorized system manipulation and potential disruption of critical operational processes.

Remediation Plan

Immediate Action: Update the ABB FLXEON software to the latest version provided by the vendor to resolve the input validation flaws. Please refer to the official ABB security advisory for specific patch installation instructions.

Proactive Monitoring: Monitor system logs for unauthorized configuration changes, anomalous administrative activity, or unexpected process execution patterns that may indicate an exploitation attempt.

Compensating Controls: Restrict administrative access to the FLXEON interface to trusted, secure workstations and ensure that network-level access is limited to authorized personnel only.

Exploitation Status

Public Exploit Available: No — exploit_available (false).

Analyst Notes: As of September 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high privileges significantly limits the attack surface, but the potential for remote code execution necessitates prompt patching.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a significant security risk to environments utilizing ABB FLXEON. Administrators should prioritize identifying all instances of the affected software within their infrastructure and apply the vendor-supplied updates immediately. Ensuring that access controls are strictly enforced is essential to mitigating the risk while the update process is underway.

Description Summary:
A hard-coded credentials vulnerability exists in ABB FLXEON, allowing potential unauthorized access or control of the affected system.

Executive Summary:
The ABB FLXEON product is affected by a hard-coded credentials vulnerability that could result in a complete compromise of system integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2024-48842

Affected Software: ABB FLXEON

Affected Versions: 0 through 9.3.5

Vulnerability: This vulnerability is caused by the use of hard-coded credentials within the application, which may allow an authenticated user with low privileges to bypass standard authentication mechanisms. The flaw resides in the core authentication logic of the FLXEON platform.

Business Impact

The presence of hard-coded credentials poses a significant risk to operational technology environments where ABB FLXEON is deployed. A successful exploit could lead to full system compromise, resulting in unauthorized control of industrial processes, data theft, or complete loss of system availability. With a CVSS score of 7.0, this issue is classified as High severity and requires immediate prioritization to prevent unauthorized access to critical infrastructure.

Remediation Plan

Immediate Action: Update the ABB FLXEON software to the latest version provided by the vendor to remove the hard-coded credentials.

Proactive Monitoring: Review system access logs for anomalous login patterns or unauthorized administrative actions originating from low-privileged accounts.

Compensating Controls: Implement strict network segmentation and restrict physical and logical access to the management interfaces of the affected FLXEON devices to minimize the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploitability is hindered by the requirement for physical or local network access and specific conditions, the nature of hard-coded credentials makes the system inherently vulnerable if an attacker gains the necessary baseline access.

Analyst Recommendation

Given the potential for total impact on the affected system, organizations must treat this vulnerability with high urgency. Administrators should consult the official ABB security advisory immediately to verify if a patch is available for their specific deployment and apply it as soon as possible. In environments where immediate patching is not feasible, ensure that network-level access controls are robust enough to prevent unauthorized parties from reaching the vulnerable interface.

Description Summary:
A cross-site scripting vulnerability exists in ABB EIBPORT V3 KNX and KNX GSM devices, allowing attackers to inject malicious scripts into web pages.

Executive Summary:
An improper input neutralization vulnerability in ABB EIBPORT V3 devices permits cross-site scripting attacks that could compromise user sessions and interface integrity.

Vulnerability Details

CVE-ID: CVE-2021-22291

Affected Software: ABB EIBPORT V3 KNX and EIBPORT V3 KNX GSM

Affected Versions: 0 up to (excluding) 3.9.2

Vulnerability: The product fails to properly neutralize user-supplied input during web page generation, leading to CWE-79 (Cross-site Scripting). Based on the CVSS vector (PR:L), this vulnerability requires a low-privileged authenticated user to trigger the malicious script in the context of an active session.

Business Impact

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, unauthorized actions, or the theft of sensitive configuration data. With a CVSS score of 8.0, this is classified as a High severity issue, posing significant risks to the operational control and management security of the affected industrial automation systems.

Remediation Plan

Immediate Action: Update all instances of ABB EIBPORT V3 KNX and EIBPORT V3 KNX GSM to firmware version 3.9.2 or later as specified in the vendor security advisory.

Proactive Monitoring: Review web server and application access logs for unusual patterns, such as unexpected script tags or encoded characters in URL parameters and input fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rules to detect and block common cross-site scripting attack patterns targeting the device web interface.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of October 8, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically exploitable, the requirement for authenticated access limits the attack surface to existing users.

Analyst Recommendation

Given the High severity rating of this vulnerability, administrators should prioritize the firmware update to version 3.9.2 to eliminate the underlying injection flaw. Failure to patch these devices leaves the management interface susceptible to manipulation, which could lead to broader compromise of the connected KNX control environment.