View CSAF

Summary

ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities. An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691).

The following versions of ABB AC500 V3 Multiple Vulnerabilities are affected:

AC500 V3 <3.9.0, 3.9.0

CVSS Vendor Equipment Vulnerabilities

v3 8.3 ABB ABB AC500 V3 Multiple Vulnerabilities Direct Request ('Forced Browsing'), Incorrect Permission Assignment for Critical Resource, NULL Pointer Dereference

Background

Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Switzerland

Expand All +

CVE-2025-2595

The visualization allows users to create browser-based…