AC500 V3 - Invalid type usage in visualization
An update is available that resolves publicly reported vulnerability in the products versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could cause a denial-of-service (DoS).
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41738US | — | — | ||
An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading t… | ||||
references
External citations — patches, advisories, analysis.
remediations (3)
- MitigationABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxx
Refer to section “General security recommendations” for further advise on how to keep your system secure.
- FixedABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxx
The problem is corrected in the following product version: - AC500 V3 firmware version 3.9.1 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and integrated into Automation Builder 2.9.1. Automation Builder 2.9.1 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- WorkaroundABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxx
Disable the web server, if it is enabled, but not required for the PLC operation.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan