ABB CoreSense CVE-2025-3465

Per the vendor CVSS 4.0 vector, exploitation requires local access (AV:L) to an affected ABB CoreSense HM (≤2.3.1) or CoreSense M10 (≤1.4.1.12) unit, with no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L). The description states no 'when configured with' precondition, so no special configuration is named. The primary limiting factor is the local attack vector: an attacker must already be able to interact directly with the device's file-handling interface rather than reaching it from an arbitrary remote network location, which substantially narrows realistic exposure to adversaries with physical or local-network/console proximity to the monitoring hardware.

This is a genuine but not urgent priority. The vendor-supplied CVSS 4.0 vector (base 8.2, High) emphasizes a local attack vector (AV:L) with no privileges or user interaction (PR:N/UI:N), high confidentiality impact on both the vulnerable and a subsequent system (VC:H, SC:H), and no integrity or availability impact (VI:N/VA:N). The signals point toward information disclosure via file read, not code execution or disruption. Real-world exploitation signals are low: EPSS is only 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit code is identified, so there is no public exploit identified at time of analysis. A notable tension exists in the data: CWE-22 path traversal in a device of this class is very often reached over a network/web management interface (AV:N), yet the vendor rated it AV:L (local), which materially lowers practical reachability - verify with ABB whether exploitation requires local/console access or a reachable network service. The high base score is driven largely by the confidentiality-only impact plus the scope/subsequent-system (SC:H) rating rather than by any confirmed exploitation, so treat this as a high-CVSS, low-current-real-risk issue that should be patched on a normal cycle, prioritized higher only in utility/substation environments where the device is network-exposed.

An actor with local access to an ABB CoreSense HM or M10 transformer-monitoring unit supplies a crafted pathname containing directory-traversal sequences to a file-handling function, escaping the intended restricted directory to read sensitive files (e.g., configuration, credentials, or monitoring data). No authentication or user interaction is required per the vendor vector, but the local attack vector means the attacker must first reach the device directly. No public proof-of-concept or active exploitation has been reported.