EUVD-2025-210051
GHSA-vc9h-72v9-5249
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (ABB) · only source for this CVE.
CVSS VectorVendor: ABB
Lifecycle Timeline
5DescriptionCVE.org
Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
AnalysisAI
Authorization bypass in ABB T-MAC Plus version 4.0-24 allows authenticated remote attackers to access or modify resources belonging to other users by manipulating user-controlled identifiers (IDOR). The flaw scores CVSS 7.3 with high impact to integrity and availability, and no public exploit identified at time of analysis. The vulnerability was reported by the vendor (ABB) itself, indicating coordinated disclosure rather than incident-driven discovery.
Technical ContextAI
ABB T-MAC Plus is an industrial energy and power-quality monitoring/measurement device produced by ABB, typically deployed in operational technology (OT) and electrical-distribution environments. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of insecure direct object reference (IDOR) where the application uses an identifier supplied by the requester (such as a numeric record ID, account ID, or resource handle in a URL or parameter) to fetch data without verifying that the requesting session is actually authorized to access that specific object. The CPE 'cpe:2.3:a:abb:t-mac_plus:*' confirms the application-tier T-MAC Plus product is affected, and the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) indicates the flaw is reachable over the network by an already-authenticated low-privilege user, with an additional attack requirement (AT:P) suggesting a precondition such as knowing or enumerating another resource identifier.
RemediationAI
Consult the ABB security advisory at https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A7840&LanguageCode=en&DocumentPartId=&Action=Launch for the vendor-recommended fixed firmware or software release; the input data does not contain an independently confirmed fix version, so treat the advisory as the authoritative patch source (patch available per vendor advisory). Until the upgrade can be staged, place T-MAC Plus devices behind a strict network segmentation boundary so that the management interface is reachable only from a dedicated jump host or engineering workstation (trade-off: legitimate remote monitoring workflows will need to traverse the jump host); rotate and restrict low-privilege accounts to the minimum personnel needed, since exploitation requires PR:L access; and enable application-layer logging of object-access requests so anomalous ID enumeration can be detected. Avoid exposing the device's HTTP/management endpoints to corporate or internet networks, which removes the network attack vector entirely at the cost of losing remote access.
More in T Mac Plus
View allUnauthorized file or directory access in ABB T-MAC Plus version 4.0-24 allows authenticated remote attackers to read, mo
Stored/reflected cross-site scripting in ABB T-MAC Plus version 4.0-24 allows authenticated low-privileged attackers to
Authorization bypass in ABB T-MAC Plus version 4.0-24 allows adjacent-network attackers to perform unauthorized actions
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today