ABB T-MAC Plus CVE-2025-14771

Attacker must hold low-privileged authenticated access to a T-MAC Plus 4.0-24 deployment reachable over the network (CVSS PR:L, AV:N), and the environment must satisfy the present attack requirement (AT:P) - typically meaning the vulnerable file/directory-exposing feature is enabled or the device is configured in a deployment mode where the affected resource handler is reachable. Exploitation is limited by the need for valid credentials, by the requirement that the specific T-MAC Plus build 4.0-24 is in use, and by the typical ICS deployment pattern in which these devices live on segmented operational networks rather than on the public internet; user interaction is not required (UI:N).

The CVSS 4.0 vector indicates network attack vector with low complexity but requires an Attack Requirement (AT:P, a present/specific condition) and low privileges (PR:L), meaning the attacker must already have some authenticated foothold and the target environment must meet a particular precondition. Impact is asymmetric - high confidentiality (VC:H) and high availability (VA:H) on the vulnerable system, plus high confidentiality and availability impact on subsequent systems (SC:H, SA:H), reflecting that T-MAC Plus often sits adjacent to operational/OT assets. No EPSS score, KEV listing, or public POC is provided, so although the 7.3 base score is meaningful, real-world exploitation pressure appears low; however, ICS/OT products tend to have long patch cycles and limited external visibility, so absence of public exploit data should not be read as absence of risk. The PR:L requirement is a notable limiter that pushes this below truly critical priority for internet-exposed assets but raises it for any environment where insider or compromised-credential threat models are in scope.

An attacker who has obtained low-privileged credentials to a T-MAC Plus 4.0-24 instance - for example, a contractor account, a re-used operator password, or a credential lifted from a compromised engineering workstation - issues crafted requests against the exposed file-handling interface to read configuration, logs, or other resources outside the intended directory. Because scope-change impact is high (SC:H/SA:H), the disclosed material or induced availability loss can cascade into adjacent metering, billing, or control systems that trust T-MAC Plus output. No public exploit is identified at time of analysis, so this scenario assumes capability development by the attacker.