ABB Terra AC CVE-2025-5517

Exploitation requires authenticated low-privilege access to the wallbox (PR:L) plus satisfaction of specific attack preconditions (AT:P) and high attack complexity (AC:H) - meaning the attacker must reach and authenticate to the device's network-exposed management/charging interface and meet non-trivial conditions to reliably trigger the heap overflow. Affected builds are version-bounded: Terra AC (UL40/80A) and (MID/CE Terra AC MID, Juno CE) through 1.8.32, (UL32A) and (JP) through 1.8.2, and (MID/CE Terra AC PTB) through 1.8.21. Limiting factors: the required authentication, the elevated complexity/preconditions, device-local scope (no subsequent-system impact), and the need to reach a specific ABB EV-charger model on an accessible network substantially narrow realistic exploitability.

This is a moderate, not a top-tier, priority. The CVSS 4.0 base score is 6.1 (Medium), and the vector itself tempers the network-reachable surface: AC:H combined with AT:P means exploitation requires high complexity plus specific attack preconditions/timing, and PR:L means the attacker must already hold at least low-privilege authenticated access to the wallbox. Impact is scoped to the vulnerable device only (SC:N/SI:N/SA:N) and hits integrity and availability (VI:H/VA:H) but not confidentiality (VC:N), consistent with a heap overflow (CWE-122) that can crash or alter firmware behavior rather than leak data. The exploitation-probability signals all point low: EPSS is 0.28% (19th percentile), there is no CISA KEV listing, and no public exploit code was provided - so this is 'no public exploit identified at time of analysis.' The CVE was reported by ABB's own security team (cybersecurity@ch.abb.com), indicating coordinated vendor disclosure rather than observed in-the-wild abuse. No signals conflict; they consistently indicate a genuine but gated firmware flaw in specialized EV-charging hardware, best treated as a routine-to-prioritized patch for operators of these devices rather than an emergency.

An attacker who already holds low-privilege authenticated access to an ABB Terra AC wallbox (e.g., via its management/charging protocol interface on the reachable network) sends a crafted oversized message that overruns a heap buffer in the firmware. Under the required high-complexity conditions, this corrupts device memory to degrade availability or tamper with charging integrity. No public exploit code is known, and the AC:H/AT:P/PR:L profile makes opportunistic mass exploitation unlikely.