CVE-2025-6074
mediumPriorität · verfolgen · 0OT-Risiko · erhöhtEPSS 0.003 · 22. PerzentilCHEURUUSEPSS · bewertet 2026-10-27
Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenRMC-100abb_psirt
The problem is corrected in RMC-100 version (2105457-046) and RMC-100 LITE version (2106229-018)
- BehobenRMC-100 LITEabb_psirt
The problem is corrected in RMC-100 version (2105457-046) and RMC-100 LITE version (2106229-018)
- BehobenRMC-100cisa_csaf_ot
The problem is corrected in RMC-100 version (2105457-046) and RMC-100 LITE version (2106229-018)
- BehobenRMC-100 LITEcisa_csaf_ot
The problem is corrected in RMC-100 version (2105457-046) and RMC-100 LITE version (2106229-018)
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.7–6.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (16)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- 9AKK108471A3623RMC - 100 Vulnerabilities in web UI (REST Interface)2025-07-03csaf · abb_psirtCH
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could gain unauthenticated access to the MQTT configu-ration data (CVE-2025-6074), cause a DoS on the MQTT configuration web server (REST interface) (CVE-2025-6073, CVE-2025-6072), or decrypt encrypted MQTT broker credentials (CVE-2025-6071).
- ICSA-25-196-02ABB RMC-100 (Update A)2025-07-03icsa · cisa_csaf_otUS
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could gain unauthenticated access to the MQTT configu-ration data (CVE-2025-6074), cause a DoS on the MQTT configuration web server (REST interface) (CVE-2025-6073, CVE-2025-6072), or decrypt encrypted MQTT broker credentials (CVE-2025-6071).
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (4)
Externe Belege — Patches, Meldungen, Analysen.
- https://new.abb.com/products/measurement-products/upstream-oil-and-gas/flow-computers-remote-controllers/flow-computers/rmcPatchcnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A3623&LanguageCode=en&DocumentPartId=PDF&Action=Launchcnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A3623&LanguageCode=en&DocumentPartId=PDF&Action=Launchenisa_euvd
- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A3623&LanguageCode=en&DocumentPartId=PDF&Action=Launchnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan