ABB Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with ABB products.
Products
- ASPECT-Enterprise58 vulnerabilities
- MATRIX Series58 vulnerabilities
- NEXUS Series58 vulnerabilities
- matrix_series22 vulnerabilities
- nexus_series22 vulnerabilities
- aspect_enterprise21 vulnerabilities
- eSOMS13 vulnerabilities
- ABB Ability™ Symphony® Plus Operations9 vulnerabilities
- ABB Ability™ Symphony® Plus Historian8 vulnerabilities
- AdvaBuild7 vulnerabilities
- FLXEON7 vulnerabilities
- Symphony Plus S+ Operations7 vulnerabilities
- Control Builder Safe6 vulnerabilities
- Symphony Plus S+ Engineering6 vulnerabilities
- ABB Ability System 800xA5 vulnerabilities
- Advant OCS AC 100 OPS Server5 vulnerabilities
- Advant OCS Control Builder A5 vulnerabilities
- Central Licensing System5 vulnerabilities
- Compact HMI5 vulnerabilities
- Composer CTK5 vulnerabilities
- Composer Harmony5 vulnerabilities
- Composer Melody5 vulnerabilities
- Harmony OPC Server Standalone5 vulnerabilities
- Knowledge Manager5 vulnerabilities
- Manufacturing Operations Management5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-12705MEDIUM | Integrity mechanism of KNX-device FW-files can be bypassed in ABB Update ToolMissing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). This issue affects KNX Update Tool (ABB): through 2.0.175; KNX Update Tool (BJE): through 2.0.175. CWE-353Jul 17, 2026 | CVSS5.9v4.0 | EPSS0.098% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-13162MEDIUM | Advant Master Online Builder DLL vulnerabilityUncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: through 1.4/4; 800xA for Advant Master: through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1. CWE-427Jun 23, 2026 | CVSS4.1v4.0 | EPSS0.083% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-7064MEDIUM | Freelance Security Lock – Access to Windows OSAuthentication bypass by primary weakness vulnerability in ABB Freelance. This issue affects Freelance: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1, 2019 SP1 FP1, 2024. CWE-305Jun 11, 2026 | CVSS5.6v4.0 | EPSS0.116% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-14774HIGH | Communication analysis between the Card Reader and TP2CardReaderService daemonIncorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. CWE-863Jun 3, 2026 | CVSS7.2v4.0 | EPSS0.18% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-14773HIGH | Stored Cross-Site Scripting in ABB T-MAC Plus web applicationImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. CWE-79Jun 3, 2026 | CVSS7.2v4.0 | EPSS0.181% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-14772HIGH | Broken Access Control in ABB T-MAC Plus web applicationAuthorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. CWE-639Jun 3, 2026 | CVSS7.3v4.0 | EPSS0.292% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-14771HIGH | File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web SiteFiles or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. CWE-552Jun 3, 2026 | CVSS7.3v4.0 | EPSS0.347% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-3756HIGH | Denial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attacker with access to IEC 61850 networks could exploit the vulnera bility by using a specially crafted 61850 packet, forcing the communication interfaces of the PM 877, CI850 and CI868 modules into fault mode or causing unavailability of the S+ Operations 61850 connectivity, resulting in a denial-of-service situation. The System 800xA IEC… CWE-1284Apr 13, 2026 | CVSS7.1v4.0 | EPSS0.184% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-13779HIGH | Generated title:ABB AWIN GW100 rev.2 and AWIN GW120 Missing Authentication for Critical FunctionMissing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1. CWE-306Mar 13, 2026 | CVSS7.2v4.0 | EPSS0.285% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-13778HIGH | Generated title:ABB AWIN GW100 rev.2 and AWIN GW120 Missing Authentication for Critical FunctionMissing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1. CWE-306Mar 13, 2026 | CVSS7.1v4.0 | EPSS0.274% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-13777HIGH | Authentication Bypass due to Improper Session ValidationAuthentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1. CWE-294Mar 13, 2026 | CVSS7.2v4.0 | EPSS0.228% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-14510CRITICAL | ABB Ability OPTIMAX Authentication Bypass in Single-Sign OnIncorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 before 6.3.1-251120, from 6.4.0 before 6.4.1-251120. CWE-303Jan 16, 2026 | CVSS9.2v4.0 | EPSS0.39% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-4677HIGH | Idle session timeout is not configured for multiple open portsInsufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K. CWE-613Jan 7, 2026 | CVSS7.1v4.0 | EPSS0.193% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-4676HIGH | Authentication bypass by brute forcing Authentication HeadersIncorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K. CWE-303Jan 7, 2026 | CVSS8.4v4.0 | EPSS0.255% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-4675HIGH | Improper implementation of Modbus protocol leading to DOS attackImproper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K. CWE-754Jan 7, 2026 | CVSS7.1v4.0 | EPSS0.191% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12143MEDIUM | Stack Memory Corruption VulnerabilityStack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33. CWE-121Nov 28, 2025 | CVSS6.9v4.0 | EPSS0.197% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-10571CRITICAL | ABB Ability Edgenius Authentication BypassAuthentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. CWE-288Nov 20, 2025 | CVSS9.4v4.0 | EPSS0.314% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12142MEDIUM | BSS(Block Started by Symbol) Memory Corruption VulnerabilityBuffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33. CWE-120Oct 29, 2025 | CVSS6.9v4.0 | EPSS0.202% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-5517MEDIUM | Heap Memory Corruption VulnerabilityHeap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (MID/ CE) -Terra AC MID, ABB Terra AC wallbox (MID/ CE) -Terra AC Juno CE, ABB Terra AC wallbox (MID/ CE) -Terra AC PTB, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): through 1.8.32; Terra AC wallbox (UL32A): through 1.8.2; Terra AC wallbox (MID/ CE) -Terra AC MID: through 1.8.32; Terra AC wallbox (MID/ CE) -Terra AC Juno CE: through 1.8.32; … CWE-122Oct 20, 2025 | CVSS6.1v4.0 | EPSS0.273% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-3465HIGH | Path Traversal VulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSense™ HM: through 2.3.1; CoreSense™ M10: through 1.4.1.12. CWE-22Oct 20, 2025 | CVSS8.2v4.0 | EPSS0.179% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-9574CRITICAL | Missing Authentication VulnerabilityMissing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . All firmware versions with the Serial Number from 2000 to 5166 CWE-306Oct 20, 2025 | CVSS9.9v4.0 | EPSS0.745% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-9970MEDIUM | Application credential stored in clear text in memoryCleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21. CWE-316Oct 8, 2025 | CVSS5.7v4.0 | EPSS0.095% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-22291HIGH | EIBPORT Reflected XSSImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ABB EIBPORT V3 KNX, ABB EIBPORT V3 KNX GSM.This issue affects EIBPORT V3 KNX: before 3.9.2; EIBPORT V3 KNX GSM: before 3.9.2. CWE-79Oct 7, 2025 | CVSS8.5v4.0 | EPSS0.305% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-10504MEDIUM | Heap Memory Corruption VulnerabilityHeap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33. CWE-122Sep 29, 2025 | CVSS6.9v4.0 | EPSS0.202% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-10207HIGH | Authenticated File Disclosure/DeleteImproper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. CWE-1287Sep 18, 2025 | CVSS7.5v4.0 | EPSS0.33% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |