ABB vulnerabilities

Products

• ASPECT®-Enterprise 60
• MATRIX Series 60
• NEXUS Series 60
• aspect-ent-12 firmware 29
• aspect-ent-2 firmware 29
• aspect-ent-256 firmware 29
• aspect-ent-96 firmware 29
• matrix-11 firmware 29
• matrix-216 firmware 29
• matrix-232 firmware 29
• matrix-264 firmware 29
• matrix-296 firmware 29
• nexus-2128 firmware 29
• nexus-2128-a firmware 29
• nexus-2128-f firmware 29
• nexus-2128-g firmware 29
• nexus-264 firmware 29
• nexus-264-a firmware 29
• nexus-264-f firmware 29
• nexus-264-g firmware 29
• nexus-3-2128 firmware 29
• nexus-3-264 firmware 29
• aspect enterprise 21
• eSOMS 13
• ABB Ability™ Symphony® Plus Operations 9
• symphony + historian 9
• symphony + operations 9
• ABB Ability™ Symphony® Plus Historian 8
• advabuild 7
• FLXEON 7

Latest ABB CVEs

Newest publication first · page 1 of 11

1. CVE-2026-13599 ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB

   Published 2026-10-22

   Medium·CVSS 5.8

   Missing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0.

2. CVE-2026-17525 My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion

   Published 2026-10-15

   Medium·CVSS 5.1

   Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.

3. CVE-2026-15953 Path Traversal During Project Archive Import

   Published 2026-09-28

   Medium·CVSS 5.6

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.

4. CVE-2026-15952 Improper Permission Assignment in Scheduler Service

   Published 2026-09-28

   High·CVSS 7.1

   Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.

5. CVE-2026-19438 Mint Workbench I Path traversal Vulnerability

   Published 2026-09-23

   High·CVSS 8.2

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I. This issue affects Mint Workbench I: through 5876.

6. CVE-2023-5778 Missing Length Check

   Published 2026-09-18

   Critical·CVSS 9.2

   Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900. This issue affects Freelance Controller DCP: through 2013, 2013 SP1, 2016, 2016 S...

7. CVE-2026-12705 Integrity mechanism of KNX-device FW-files can be bypassed in ABB Update Tool

   Published 2026-07-17

   Medium·CVSS 5.9

   Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). This issue affects KNX Update Tool (ABB): through 2.0.175; KNX Update Tool (BJE): through 2.0.175.

8. CVE-2025-13162 Advant Master Online Builder DLL vulnerability

   Published 2026-06-23

   Medium·CVSS 4.1

   Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: through 1.4/4; 800xA for Advant Master: through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1.

9. CVE-2025-7064 Freelance Security Lock – Access to Windows OS

   Published 2026-06-11

   Medium·CVSS 5.6

   Authentication bypass by primary weakness vulnerability in ABB Freelance. This issue affects Freelance: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1, 2019 SP1 FP1, 2024.

10. CVE-2025-14774 Communication analysis between the Card Reader and TP2CardReaderService daemon

    Published 2026-06-03

    High·CVSS 7.2

    Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

11. CVE-2025-14773 Stored Cross-Site Scripting in ABB T-MAC Plus web application

    Published 2026-06-03

    High·CVSS 7.2

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

12. CVE-2025-14772 Broken Access Control in ABB T-MAC Plus web application

    Published 2026-06-03

    High·CVSS 7.3

    Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

13. CVE-2025-14771 File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web Site

    Published 2026-06-03

    High·CVSS 7.3

    Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

14. CVE-2025-3756 Denial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850

    Published 2026-04-13

    High·CVSS 7.1

    A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attacker with access to IEC 61850 networks could exploit the vulnera bility by using a specially crafted 61850 packet, forcing...

15. CVE-2025-13779 Configuration Data Spill

    Published 2026-03-13

    High·CVSS 7.2

    Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.

16. CVE-2025-13778 Device Reboot Control

    Published 2026-03-13

    High·CVSS 7.1

    Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.

17. CVE-2025-13777 Authentication Bypass due to Improper Session Validation

    Published 2026-03-13

    High·CVSS 7.2

    Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.

18. CVE-2025-14510 ABB Ability OPTIMAX Authentication Bypass in Single-Sign On

    Published 2026-01-16

    Critical·CVSS 9.2

    Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 before 6.3.1-251120, from 6.4.0 before 6.4.1-251120.

19. CVE-2025-4677 Idle session timeout is not configured for multiple open ports

    Published 2026-01-07

    High·CVSS 7.1

    Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.

20. CVE-2025-4676 Authentication bypass by brute forcing Authentication Headers

    Published 2026-01-07

    High·CVSS 8.4

    Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.

21. CVE-2025-4675 Improper implementation of Modbus protocol leading to DOS attack

    Published 2026-01-07

    High·CVSS 7.1

    Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.

22. CVE-2025-12143 Stack Memory Corruption Vulnerability

    Published 2025-11-28

    Medium·CVSS 6.9

    Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.

23. CVE-2025-10571 ABB Ability Edgenius Authentication Bypass

    Published 2025-11-20

    Critical·CVSS 9.4

    Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.

24. CVE-2025-12142 BSS(Block Started by Symbol) Memory Corruption Vulnerability

    Published 2025-10-29

    Medium·CVSS 6.9

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.

25. CVE-2025-5517 Heap Memory Corruption Vulnerability

    Published 2025-10-20

    Medium·CVSS 6.1

    Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (MID/ CE) -Terra AC MID, ABB Terra AC wallbox (MID/ CE) -Terra AC Juno CE, ABB Terra AC wallbox (MID/ CE) -Terra AC PTB, ABB Terra AC wallbox (JP).This...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.