ABB vulnerabilities
Published CVEs affecting ABB products: 21 record(s), with severity, exploitation and fixes.
T-mac Plus 4AWIN GW100 rev.2 3AWIN GW120 3WebPro SNMP Card PowerValue 3WebPro SNMP Card PowerValue UL 3Terra AC wallbox 3My Control System 1Freelance 1Terra AC wallbox (JP) 1Terra AC wallbox (MID/ CE) -Terra AC PTB 1Terra AC wallbox (MID/ CE) -Terra AC Juno CE 1Terra AC wallbox (MID/ CE) -Terra AC MID 1Terra AC wallbox (UL32A) 1Terra AC wallbox (UL40/80A) 1800xA for Advant Master 1Control Builder A 1ABB Ability OPTIMAX 1ABB Ability Edgenius 1CoreSense™ M10 1CoreSense™ HM 1S+ Operations 1Symphony Plus MR (Melody Rack) 1Symphony Plus SD Series 1AC800M (System 800xA) 1
CVE-2026-17525
Medium · 5.2
CWE-459 Oct 15, 2026
My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion
Incomplete cleanup vulnerability in ABB My Control System.
This issue affects My Control System: 26.4 and 26.5.
CVE-2025-13162
Medium · 4.4
CWE-427 Jun 23, 2026
Advant Master Online Builder DLL vulnerability
Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master.
This issue affects Control Builder A: through 1.4/4; 800xA for Advant Master: through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1.
CVE-2025-7064
Medium · 6.6
CWE-305 Jun 11, 2026
Freelance Security Lock – Access to Windows OS
Authentication bypass by primary weakness vulnerability in ABB Freelance.
This issue affects Freelance: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1, 2019 SP1 FP1, 2024.
CVE-2025-14774
High · 7.4
CWE-863 Jun 3, 2026
Communication analysis between the Card Reader and TP2CardReaderService daemon
Incorrect Authorization vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
CVE-2025-14773
Medium · 5.4
CWE-79 Jun 3, 2026
Stored Cross-Site Scripting in ABB T-MAC Plus web application
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
CVE-2025-14772
High · 8.8
CWE-639 Jun 3, 2026
Broken Access Control in ABB T-MAC Plus web application
Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
CVE-2025-14771
Critical · 9.9
CWE-552 Jun 3, 2026
File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web Site
Files or directories accessible to external parties vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
CVE-2025-3756
Medium · 6.5
CWE-1284 Apr 13, 2026
Denial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850
A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attacker with access to IEC 61850 networks could exploit the vulnera bility by using a specially crafted 61850 packet, forcing the communication interfaces of the PM 877, CI850 and CI868 modules into fault mode or causing unavailability of the S+ Operations 61850 connectivity, resulting in a denial-of-service situation.
The System 800xA IEC61850 Connect is not affected. Note: This vulnerability does not impact on the overall availability and functionality of the S+ Operations node, only the 61850 communication function.
This issue affects AC800M (System 800xA): from 6.0.0x through 6.0.0303.0, from 6.1.0x through 6.1.0031.0, from 6.1.1x through 6.1.1004.0, from 6.1.1x through 6.1.1202.0, from 6.2.0x through 6.2.0006.0; Symphony Plus SD Series: A_0, A_1, A_2.003, A_3.005, A_4.001, B_0.005; Symphony Plus MR (Melody Rack): from 3.10 through 3.52; S+ Operations: 2.1, 2.2, 2.3, 3.3.
CVE-2025-13779
High · 8.3
CWE-306 Mar 13, 2026
Configuration Data Spill
Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
CVE-2025-13778
Medium · 6.5
CWE-306 Mar 13, 2026
Device Reboot Control
Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
CVE-2025-13777
High · 8.3
CWE-294 Mar 13, 2026
Authentication Bypass due to Improper Session Validation
Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
CVE-2025-14510
High · 8.1
CWE-303 Jan 16, 2026
ABB Ability OPTIMAX Authentication Bypass in Single-Sign On
Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 before 6.3.1-251120, from 6.4.0 before 6.4.1-251120.
CVE-2025-4677
Medium · 6.5
CWE-613 Jan 7, 2026
Idle session timeout is not configured for multiple open ports
Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
CVE-2025-4676
High · 8.8
CWE-303 Jan 7, 2026
Authentication bypass by brute forcing Authentication Headers
Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
CVE-2025-4675
Medium · 6.5
CWE-754 Jan 7, 2026
Improper implementation of Modbus protocol leading to DOS attack
Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
CVE-2025-12143
Medium · 6.1
CWE-121 Nov 28, 2025
Stack Memory Corruption Vulnerability
Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
CVE-2025-10571
Critical · 9.6
CWE-288 Nov 20, 2025
ABB Ability Edgenius Authentication Bypass
Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.
CVE-2025-12142
Medium · 6.1
CWE-120 Oct 29, 2025
BSS(Block Started by Symbol) Memory Corruption Vulnerability
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
CVE-2025-5517
Medium · 6.8
CWE-122 Oct 20, 2025
Heap Memory Corruption Vulnerability
Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (MID/ CE) -Terra AC MID, ABB Terra AC wallbox (MID/ CE) -Terra AC Juno CE, ABB Terra AC wallbox (MID/ CE) -Terra AC PTB, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): through 1.8.32; Terra AC wallbox (UL32A): through 1.8.2; Terra AC wallbox (MID/ CE) -Terra AC MID: through 1.8.32; Terra AC wallbox (MID/ CE) -Terra AC Juno CE: through 1.8.32; Terra AC wallbox (MID/ CE) -Terra AC PTB: through 1.8.21; Terra AC wallbox (JP): through 1.8.2.
CVE-2025-3465
High · 7.1
CWE-22 Oct 20, 2025
Path Traversal Vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSense™ HM: through 2.3.1; CoreSense™ M10: through 1.4.1.12.
CVE-2025-10504
Medium · 6.1
CWE-122 Sep 29, 2025
Heap Memory Corruption Vulnerability
Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.