Vulnerabilidades de ABB
CVEs publicadas que afetam produtos de ABB: 22 registro(s), com severidade, exploração e correções.
T-mac Plus 4AWIN GW100 rev.2 3AWIN GW120 3WebPro SNMP Card PowerValue 3WebPro SNMP Card PowerValue UL 3Terra AC wallbox 3KNX Update Tool (BJE) 1KNX Update Tool (ABB) 1My Control System 1Freelance 1Terra AC wallbox (JP) 1Terra AC wallbox (MID/ CE) -Terra AC PTB 1Terra AC wallbox (MID/ CE) -Terra AC Juno CE 1Terra AC wallbox (MID/ CE) -Terra AC MID 1Terra AC wallbox (UL32A) 1Terra AC wallbox (UL40/80A) 1800xA for Advant Master 1Control Builder A 1ABB Ability OPTIMAX 1ABB Ability Edgenius 1CoreSense™ M10 1CoreSense™ HM 1S+ Operations 1Symphony Plus MR (Melody Rack) 1Symphony Plus SD Series 1AC800M (System 800xA) 1
CVE-2026-17525
Média · 5.2
CWE-459 15/10/2026
My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion
Incomplete cleanup vulnerability in ABB My Control System.
This issue affects My Control System: 26.4 and 26.5.
CVE-2026-12705
Média · 6.4
CWE-353 17/07/2026
Integrity mechanism of KNX-device FW-files can be bypassed in ABB Update Tool
Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE).
This issue affects KNX Update Tool (ABB): through 2.0.175; KNX Update Tool (BJE): through 2.0.175.
CVE-2025-13162
Média · 4.4
CWE-427 23/06/2026
Advant Master Online Builder DLL vulnerability
Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master.
This issue affects Control Builder A: through 1.4/4; 800xA for Advant Master: through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1.
CVE-2025-7064
Média · 6.6
CWE-305 11/06/2026
Freelance Security Lock – Access to Windows OS
Authentication bypass by primary weakness vulnerability in ABB Freelance.
This issue affects Freelance: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1, 2019 SP1 FP1, 2024.
CVE-2025-14774
Alta · 7.4
CWE-863 03/06/2026
Communication analysis between the Card Reader and TP2CardReaderService daemon
Incorrect Authorization vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
CVE-2025-14773
Média · 5.4
CWE-79 03/06/2026
Stored Cross-Site Scripting in ABB T-MAC Plus web application
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
CVE-2025-14772
Alta · 8.8
CWE-639 03/06/2026
Broken Access Control in ABB T-MAC Plus web application
Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
CVE-2025-14771
Crítica · 9.9
CWE-552 03/06/2026
File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web Site
Files or directories accessible to external parties vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
CVE-2025-3756
Média · 6.5
CWE-1284 13/04/2026
Denial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850
A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attacker with access to IEC 61850 networks could exploit the vulnera bility by using a specially crafted 61850 packet, forcing the communication interfaces of the PM 877, CI850 and CI868 modules into fault mode or causing unavailability of the S+ Operations 61850 connectivity, resulting in a denial-of-service situation.
The System 800xA IEC61850 Connect is not affected. Note: This vulnerability does not impact on the overall availability and functionality of the S+ Operations node, only the 61850 communication function.
This issue affects AC800M (System 800xA): from 6.0.0x through 6.0.0303.0, from 6.1.0x through 6.1.0031.0, from 6.1.1x through 6.1.1004.0, from 6.1.1x through 6.1.1202.0, from 6.2.0x through 6.2.0006.0; Symphony Plus SD Series: A_0, A_1, A_2.003, A_3.005, A_4.001, B_0.005; Symphony Plus MR (Melody Rack): from 3.10 through 3.52; S+ Operations: 2.1, 2.2, 2.3, 3.3.
CVE-2025-13779
Alta · 8.3
CWE-306 13/03/2026
Configuration Data Spill
Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
CVE-2025-13778
Média · 6.5
CWE-306 13/03/2026
Device Reboot Control
Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
CVE-2025-13777
Alta · 8.3
CWE-294 13/03/2026
Authentication Bypass due to Improper Session Validation
Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.
CVE-2025-14510
Alta · 8.1
CWE-303 16/01/2026
ABB Ability OPTIMAX Authentication Bypass in Single-Sign On
Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 before 6.3.1-251120, from 6.4.0 before 6.4.1-251120.
CVE-2025-4677
Média · 6.5
CWE-613 07/01/2026
Idle session timeout is not configured for multiple open ports
Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
CVE-2025-4676
Alta · 8.8
CWE-303 07/01/2026
Authentication bypass by brute forcing Authentication Headers
Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
CVE-2025-4675
Média · 6.5
CWE-754 07/01/2026
Improper implementation of Modbus protocol leading to DOS attack
Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
CVE-2025-12143
Média · 6.1
CWE-121 28/11/2025
Stack Memory Corruption Vulnerability
Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
CVE-2025-10571
Crítica · 9.6
CWE-288 20/11/2025
ABB Ability Edgenius Authentication Bypass
Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.
CVE-2025-12142
Média · 6.1
CWE-120 29/10/2025
BSS(Block Started by Symbol) Memory Corruption Vulnerability
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
CVE-2025-5517
Média · 6.8
CWE-122 20/10/2025
Heap Memory Corruption Vulnerability
Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (MID/ CE) -Terra AC MID, ABB Terra AC wallbox (MID/ CE) -Terra AC Juno CE, ABB Terra AC wallbox (MID/ CE) -Terra AC PTB, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): through 1.8.32; Terra AC wallbox (UL32A): through 1.8.2; Terra AC wallbox (MID/ CE) -Terra AC MID: through 1.8.32; Terra AC wallbox (MID/ CE) -Terra AC Juno CE: through 1.8.32; Terra AC wallbox (MID/ CE) -Terra AC PTB: through 1.8.21; Terra AC wallbox (JP): through 1.8.2.
CVE-2025-3465
Alta · 7.1
CWE-22 20/10/2025
Path Traversal Vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSense™ HM: through 2.3.1; CoreSense™ M10: through 1.4.1.12.
CVE-2025-10504
Média · 6.1
CWE-122 29/09/2025
Heap Memory Corruption Vulnerability
Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.