EUVD-2025-210046
GHSA-ch6v-382r-q8r4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (ABB) · only source for this CVE.
CVSS VectorVendor: ABB
Lifecycle Timeline
5DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24.
AnalysisAI
Stored/reflected cross-site scripting in ABB T-MAC Plus version 4.0-24 allows authenticated low-privileged attackers to inject malicious script content into the web management interface, which executes in the browsers of other users who interact with the affected pages. With a CVSS 4.0 base score of 7.2 and no public exploit identified at time of analysis, the flaw is notable because successful exploitation impacts both the vulnerable component and downstream subsequent systems with high integrity and availability consequences, reflecting the operational-technology context typical of ABB industrial products.
Technical ContextAI
T-MAC Plus is an ABB industrial monitoring/management product exposing a web-based interface (CPE cpe:2.3:a:abb:t-mac_plus). The root cause is CWE-79, improper neutralization of user-controlled input during HTML page generation: the application embeds attacker-supplied data into rendered web pages without adequate output encoding or context-aware sanitization, allowing browser execution of injected JavaScript. Because the affected component is the management plane of an OT/automation device, script execution in an operator's session can be leveraged to issue privileged actions against the underlying system, which explains the elevated VI:H/VA:H and subsequent-system SI:H/SA:H ratings in the CVSS 4.0 vector.
RemediationAI
Patch status is not explicitly declared in the supplied data, so treat this as: patch availability should be confirmed via the ABB advisory at https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A7840&LanguageCode=en&DocumentPartId=&Action=Launch and any fixed version applied as soon as released by the vendor. As compensating controls until a fix is verified, restrict network access to the T-MAC Plus web management interface to a dedicated OT management VLAN or jump host (trade-off: operators must use the bastion to reach the UI), enforce least-privilege accounts so few users have the low-privilege access PR:L requires, instruct operators not to follow untrusted links or open unexpected items inside the T-MAC Plus UI (trade-off: relies on user discipline), and consider deploying a reverse proxy or WAF in front of the interface to filter script payloads in request/response bodies (trade-off: may break legitimate UI features and requires tuning). Browser-side mitigations such as enforcing a strict Content-Security-Policy via the proxy can reduce script execution impact but may also disable parts of the management UI.
More in T Mac Plus
View allUnauthorized file or directory access in ABB T-MAC Plus version 4.0-24 allows authenticated remote attackers to read, mo
Authorization bypass in ABB T-MAC Plus version 4.0-24 allows authenticated remote attackers to access or modify resource
Authorization bypass in ABB T-MAC Plus version 4.0-24 allows adjacent-network attackers to perform unauthorized actions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today