Which versions of ABB T-MAC Plus are affected by CVE-2025-14773?

ABB T-MAC Plus 4.0-24 contains a stored and reflected cross-site scripting vulnerability that allows low-privilege authenticated users to inject malicious scripts into the web management interface,…

How to fix or mitigate CVE-2025-14773?

Within 24 hours: Inventory all ABB T-MAC Plus deployments and confirm version 4.0-24 instances; isolate any system exposed to untrusted networks from non-critical segments. Within 7 days: Implement strict network access controls (firewall rules, VPN requirement) to the web management interface and reduce the user population with access to low-privilege roles; enable security event logging for the interface. Within 30 days: Monitor ABB's security advisories for patch availability; evaluate upgrade or replacement timeline for T-MAC Plus 4.0-24 if vendor patch is not released.

ABB T-MAC Plus CVE-2025-14773

Q: What is the CVSS score of CVE-2025-14773?

CVE-2025-14773 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-210046 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-03 ABB

GHSA-ch6v-382r-q8r4

XSS Abb

7.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 11:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 11:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 11:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 11:22 NVD

8.0 (HIGH) 7.2 (HIGH)

Analysis Generated

Jun 03, 2026 - 11:01 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus.

This issue affects T-MAC Plus: 4.0-24.

AnalysisAI

Stored/reflected cross-site scripting in ABB T-MAC Plus version 4.0-24 allows authenticated low-privileged attackers to inject malicious script content into the web management interface, which executes in the browsers of other users who interact with the affected pages. With a CVSS 4.0 base score of 7.2 and no public exploit identified at time of analysis, the flaw is notable because successful exploitation impacts both the vulnerable component and downstream subsequent systems with high integrity and availability consequences, reflecting the operational-technology context typical of ABB industrial products.

Technical ContextAI

T-MAC Plus is an ABB industrial monitoring/management product exposing a web-based interface (CPE cpe:2.3:a:abb:t-mac_plus). The root cause is CWE-79, improper neutralization of user-controlled input during HTML page generation: the application embeds attacker-supplied data into rendered web pages without adequate output encoding or context-aware sanitization, allowing browser execution of injected JavaScript. Because the affected component is the management plane of an OT/automation device, script execution in an operator's session can be leveraged to issue privileged actions against the underlying system, which explains the elevated VI:H/VA:H and subsequent-system SI:H/SA:H ratings in the CVSS 4.0 vector.

RemediationAI

Patch status is not explicitly declared in the supplied data, so treat this as: patch availability should be confirmed via the ABB advisory at https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A7840&LanguageCode=en&DocumentPartId=&Action=Launch and any fixed version applied as soon as released by the vendor. As compensating controls until a fix is verified, restrict network access to the T-MAC Plus web management interface to a dedicated OT management VLAN or jump host (trade-off: operators must use the bastion to reach the UI), enforce least-privilege accounts so few users have the low-privilege access PR:L requires, instruct operators not to follow untrusted links or open unexpected items inside the T-MAC Plus UI (trade-off: relies on user discipline), and consider deploying a reverse proxy or WAF in front of the interface to filter script payloads in request/response bodies (trade-off: may break legitimate UI features and requires tuning). Browser-side mitigations such as enforcing a strict Content-Security-Policy via the proxy can reduce script execution impact but may also disable parts of the management UI.