ABB Terra AC CVE-2025-12142

Exploitation requires two concurrent conditions reflected in the CVSS vector: (1) adjacent-network access (AV:A) - the attacker must be on the same local/management network or within wireless range of the Terra AC wallbox, not reachable from the open internet; and (2) high privileges (PR:H) - the attacker must already be authenticated with elevated rights on the device. No user interaction is needed (UI:N) and attack complexity is low (AC:L). These requirements affect Terra AC wallbox firmware through version 1.8.33. The dual requirement of local adjacency plus pre-existing privileged access is the primary limiting factor that substantially narrows realistic exploitation to insiders or attackers who have already compromised the local network and device credentials.

This is a medium-severity issue (vendor CVSS 4.0 base 6.9) whose signals are internally consistent and point to a constrained, non-urgent risk. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N) shows exploitation requires adjacent-network access AND pre-existing high privileges, with no confidentiality impact (VC:N) but high integrity and availability impact (VI:H/VA:H) - i.e., an already-privileged local attacker could crash or tamper with the wallbox rather than steal data. EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing and no public exploit identified, all of which align with the restrictive attack prerequisites to indicate this is not a widespread or opportunistic threat. No signals conflict: the low EPSS, absence of KEV, and high-privilege/adjacent-vector requirement all reinforce low real-world exploitation likelihood. The vulnerability was self-reported by ABB's own security team rather than discovered through observed attacks, further supporting that this is a proactively disclosed, not actively exploited, flaw.

An attacker who already holds high-privilege access to an ABB Terra AC wallbox and is positioned on the adjacent network (e.g., the local management network or wireless range of the device) sends an oversized input that overflows a fixed-size buffer. This corrupts device memory, enabling the attacker to crash the charger or manipulate its operation (integrity/availability impact), though not to read confidential data. No public proof-of-concept exploit is available.