AC500 V3 - Invalid type usage in visualization
An update is available that resolves publicly reported vulnerability in the products versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could cause a denial-of-service (DoS).
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41738US | — | — | ||
An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a pointer of wrong type, potentially leading t… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (3)
- MitigationABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxx
Refer to section “General security recommendations” for further advise on how to keep your system secure.
- BehobenABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxx
The problem is corrected in the following product version: - AC500 V3 firmware version 3.9.1 ABB recommends that customers apply the update at earliest convenience. This firmware version is released for all AC500 V3 PLC types and integrated into Automation Builder 2.9.1. Automation Builder 2.9.1 is available for download from the related download site. https://www.abb.com/global/en/areas/motion/digital-tools/automation-builder/software-download
- WorkaroundABB AC500 V3 Firmware <3.9.1 installed on ABB AC500 V3 PM5xxx
Disable the web server, if it is enabled, but not required for the PLC operation.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan