ABB AC500 V3 Multiple Vulnerabilities
ABB became aware of severe vulnerability in the products versions listed as affected in the advisory. An update is available that resolves these vulnerabilities. An attacker who successfully exploited these vulnerabilities could bypass the user management and read visualization files (CVE-2025-2595), read and write certificates and keys (CVE-2025-41659) or cause a denial-of-service (DoS) (CVE-2025-41691).
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41691US | — | — | ||
An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, poten… | ||||
| CVE-2025-41659US | — | — | ||
A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to… | ||||
| CVE-2025-2595US | — | — | ||
An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing. | ||||
references
External citations — patches, advisories, analysis.
- 2025-05 CODESYS Visualization user management bypass in WebVisu
- 2025-07 CODESYS Control V3 - Exposed PKI folder
- 2025-08 CODESYS Control V3 - NULL Pointer Dereference
- ABB CYBERSECURITY ADVISORY - CSAF Versionself
- ICS Advisory ICSA-26-132-03 JSONself
- ABB CYBERSECURITY ADVISORY - PDF Versionself
- ICS Advisory ICSA-26-132-03 - Web Versionself
- Recommended Practicesexternal
remediations (9)
- MitigationAC500 V3
Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationAC500 V3
Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationAC500 V3
Refer to section “General security recommendations” for further advise on how to keep your system secure.
- FixedAC500 V3
The problem is corrected in the following product versions: - AC500 V3 firmware version 3.9.0 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.9.0. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- FixedAC500 V3
The problem is corrected in the following product versions: - AC500 V3 firmware version 3.9.0 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.9.0. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- FixedAC500 V3
The problem is corrected in the following product versions: - AC500 V3 firmware version 3.9.0 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and available from Automation Builder 2.9.0. Automation Builder 2.9.0 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- WorkaroundAC500 V3
No workarounds are available
- WorkaroundAC500 V3
No workarounds are available
- WorkaroundAC500 V3
No workarounds are available
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan