Abb
234 CVEs across 568 Abb products. Browse Abb vulnerabilities, severities, and proof-of-concept exploits.
Abb products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12705 | Medium | 6.4 | 2026-07-17 | Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool (BJE). This issue affects KNX Update Tool (ABB): through 2… |
CVE-2025-13162 | Medium | 4.4 | 2026-06-23 | Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: through 1.4/4; 800… |
CVE-2025-7064 | Medium | 6.6 | 2026-06-11 | Authentication bypass by primary weakness vulnerability in ABB Freelance. This issue affects Freelance: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1… |
CVE-2025-14774 | High | 7.4 | 2026-06-03 | Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. |
CVE-2025-14773 | High | 8.0 | 2026-06-03 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. |
CVE-2025-14772 | High | 8.8 | 2026-06-03 | Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. |
CVE-2025-14771 | Critical | 9.9 | 2026-06-03 | Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. |
CVE-2025-3756 | Medium | 6.5 | 2026-04-13 | A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attack… |
CVE-2025-13779 | High | 8.3 | 2026-03-13 | Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW12… |
CVE-2025-13778 | Medium | 6.5 | 2026-03-13 | Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW12… |
CVE-2025-13777 | High | 8.3 | 2026-03-13 | Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1… |
CVE-2025-14510 | High | 8.1 | 2026-01-16 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 befo… |
CVE-2025-4677 | Medium | 6.5 | 2026-01-07 | Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerV… |
CVE-2025-4676 | High | 8.8 | 2026-01-07 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects We… |
CVE-2025-4675 | Medium | 6.5 | 2026-01-07 | Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects We… |
CVE-2025-12143 | Medium | 6.1 | 2025-11-28 | Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33. |
CVE-2025-10571 | Critical | 9.6 | 2025-11-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. |
CVE-2025-12142 | Medium | 6.1 | 2025-10-29 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.3… |
CVE-2025-5517 | Medium | 6.8 | 2025-10-20 | Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (MID/ CE) -Terra AC MID, ABB Te… |
CVE-2025-3465 | High | 7.1 | 2025-10-20 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSe… |
CVE-2025-9574 | Critical | 10.0 | 2025-10-20 | Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . All firmware versions with the Seri… |
CVE-2025-9970 | High | 7.4 | 2025-10-08 | Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21. |
CVE-2021-22291 | High | 8.0 | 2025-10-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ABB EIBPORT V3 KNX, ABB EIBPORT V3 KNX GSM.This is… |
CVE-2025-10504 | Medium | 6.1 | 2025-09-29 | Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33. |
CVE-2025-10207 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. |
CVE-2024-48851 | High | 7.2 | 2025-09-18 | Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation. This is… |
CVE-2025-10205 | High | 8.8 | 2025-09-17 | Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. and newer versions |
CVE-2024-48842 | High | 7.0 | 2025-09-17 | Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions |
CVE-2025-8754 | High | 7.5 | 2025-08-13 | Missing Authentication for Critical Function vulnerability in ABB ABB AbilityTM zenon.This issue affects ABB AbilityTM zenon: from 7.50 through 14. |
CVE-2025-7679 | High | 8.1 | 2025-08-11 | The ASPECT system allows users to bypass authentication. This issue affects all versions of ASPECT |
CVE-2025-7677 | Medium | 5.9 | 2025-08-11 | A denial-of-service (DoS) attack is possible if access to the local network is provided to unauthorized users. This is due to a buffer copy issue that may lead… |
CVE-2025-53187 | Critical | 9.8 | 2025-08-11 | Due to an issue in configuration, code that was intended for debugging purposes was included in the market release of the ASPECT FW allowing an attacker to byp… |
CVE-2025-7745 | Medium | 5.8 | 2025-07-24 | Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2. |
CVE-2025-7705 | Medium | 6.8 | 2025-07-22 | : Active Debug Code vulnerability in ABB Switch Actuator 4 DU-83330, ABB Switch actuator, door/light 4 DU -83330-500.This issue affects Switch Actuator 4 DU-83… |
CVE-2025-6074 | Medium | 6.5 | 2025-07-03 | Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains ac… |
CVE-2025-6073 | High | 7.5 | 2025-07-03 | Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to th… |
CVE-2025-6072 | High | 7.5 | 2025-07-03 | Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to … |
CVE-2025-6071 | Medium | 5.3 | 2025-07-03 | Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to decrypt MQTT informa… |
CVE-2025-4407 | Medium | 6.7 | 2025-06-30 | Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1. |
CVE-2024-13967 | High | 8.8 | 2025-06-04 | This vulnerability allows the successful attacker to gain unauthorized access to a configuration web page delivered by the integrated web Server of EIBPORT. … |
CVE-2024-13945 | Medium | 6.0 | 2025-05-23 | Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPE… |
CVE-2024-51553 | Medium | 6.5 | 2025-05-22 | Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis iss… |
CVE-2024-51552 | Medium | 6.0 | 2025-05-22 | Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS S… |
CVE-2024-48848 | Medium | 6.5 | 2025-05-22 | Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis i… |
CVE-2024-13958 | Medium | 4.8 | 2025-05-22 | Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*… |
CVE-2024-13957 | High | 7.6 | 2025-05-22 | SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3… |
CVE-2024-13956 | Medium | 6.7 | 2025-05-22 | SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS… |
CVE-2024-13955 | High | 8.8 | 2025-05-22 | 2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become comprom… |
CVE-2024-13954 | Medium | 6.5 | 2025-05-22 | Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterpris… |
CVE-2024-13953 | Medium | 4.9 | 2025-05-22 | Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*… |
CVE-2024-13952 | High | 8.4 | 2025-05-22 | Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis iss… |
CVE-2024-13951 | High | 7.6 | 2025-05-22 | One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: thro… |
CVE-2024-13950 | Medium | 6.8 | 2025-05-22 | Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised.This issue… |
CVE-2024-13949 | Medium | 6.8 | 2025-05-22 | Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis i… |
CVE-2024-13948 | High | 7.3 | 2025-05-22 | Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise… |
CVE-2024-13947 | Medium | 6.0 | 2025-05-22 | Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-Enter… |
CVE-2024-13946 | Medium | 6.8 | 2025-05-22 | DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue… |
CVE-2025-30173 | Medium | 6.7 | 2025-05-22 | File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03… |
CVE-2025-30172 | High | 8.0 | 2025-05-22 | Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: throu… |
CVE-2025-30171 | Critical | 9.0 | 2025-05-22 | System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This is… |
CVE-2025-30170 | Medium | 5.5 | 2025-05-22 | Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session administrator crede… |
CVE-2025-30169 | Medium | 6.7 | 2025-05-22 | File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This issue affects ASPECT… |
CVE-2025-2410 | Critical | 9.1 | 2025-05-22 | Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become compr… |
CVE-2025-2409 | Critical | 9.1 | 2025-05-22 | File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issu… |
CVE-2024-9639 | High | 8.0 | 2025-05-22 | Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: thr… |
CVE-2024-13931 | High | 7.2 | 2025-05-22 | Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects AS… |
CVE-2024-13930 | Medium | 4.9 | 2025-05-22 | An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator credentials become comp… |
CVE-2024-13929 | High | 7.2 | 2025-05-22 | Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Ente… |
CVE-2024-13928 | High | 7.2 | 2025-05-22 | SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromis… |
CVE-2024-48853 | Critical | 9.0 | 2025-05-22 | An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue aff… |
CVE-2024-48850 | High | 7.2 | 2025-05-22 | Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources. This issue affects ASPECT-Enterprise: through 3.08.03… |
CVE-2024-9877 | Medium | 4.3 | 2025-04-30 | : Use of GET Request Method With Sensitive Query Strings vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: throug… |
CVE-2024-9876 | High | 7.3 | 2025-04-30 | : Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4… |
CVE-2024-47784 | Low | 2.6 | 2025-04-30 | Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI Th… |
CVE-2025-3395 | High | 7.1 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB Automation Builder.This issue affects Au… |
CVE-2025-3394 | High | 7.8 | 2025-04-30 | Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0. |
CVE-2024-10334 | High | 7.3 | 2025-02-10 | A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used. An attacker who successfully exploited t… |
CVE-2024-51547 | Critical | 9.8 | 2025-02-06 | Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NE… |
CVE-2024-48852 | Critical | 9.4 | 2025-01-29 | Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This i… |
CVE-2024-48849 | Critical | 9.4 | 2025-01-29 | Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affec… |
CVE-2024-48841 | Critical | 10.0 | 2025-01-27 | Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older. |
CVE-2024-12430 | High | 7.0 | 2025-01-07 | An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exists in the AC500 V3 version mentioned. Af… |
CVE-2024-12429 | Medium | 4.3 | 2025-01-07 | An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 version mentioned. A succ… |
CVE-2024-6784 | Critical | 9.9 | 2024-12-05 | Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affec… |
CVE-2024-6516 | Critical | 9.0 | 2024-12-05 | Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser. Affected products: ABB AS… |
CVE-2024-6515 | Critical | 9.6 | 2024-12-05 | Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails e… |
CVE-2024-51555 | Critical | 10.0 | 2024-12-05 | Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the install… |
CVE-2024-51554 | Critical | 9.1 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPE… |
CVE-2024-51551 | Critical | 10.0 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPE… |
CVE-2024-51550 | Critical | 10.0 | 2024-12-05 | Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. Affected products: … |
CVE-2024-51549 | Critical | 10.0 | 2024-12-05 | Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXU… |
CVE-2024-51548 | Critical | 9.9 | 2024-12-05 | Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRI… |
CVE-2024-51546 | High | 7.5 | 2024-12-05 | Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series… |
CVE-2024-51545 | Critical | 10.0 | 2024-12-05 | Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products: ABB ASPECT - Ente… |
CVE-2024-51544 | High | 8.2 | 2024-12-05 | Service Control vulnerabilities allow access to service restart requests and vm configuration settings. Affected products: ABB ASPECT - Enterprise v3.08.02… |
CVE-2024-51543 | High | 8.2 | 2024-12-05 | Information Disclosure vulnerabilities allow access to application configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Se… |
CVE-2024-51542 | High | 8.2 | 2024-12-05 | Configuration Download vulnerabilities allow access to dependency configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Ser… |
CVE-2024-51541 | High | 8.2 | 2024-12-05 | Local File Inclusion vulnerabilities allow access to sensitive system information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08… |
CVE-2024-48847 | High | 8.2 | 2024-12-05 | MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affect… |
CVE-2024-48846 | High | 7.1 | 2024-12-05 | Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected product… |