ABB Freelance CVE-2025-7064

Q: What is the CVSS score of CVE-2025-7064?

CVE-2025-7064 has a CVSS 4.0 base score of 5.6 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Green. EPSS exploitation probability: 0.0%.

EUVD-2025-210109 MEDIUM

Authentication Bypass by Primary Weakness (CWE-305)

2026-06-11 ABB

GHSA-385f-mwvx-qwq5

Authentication Bypass Abb

5.6

CVSS 4.0 · Vendor: ABB

Severity by source

Vendor (ABB) PRIMARY

5.6 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Green

vuln.today AI

6.6 MEDIUM

Local access with low-privilege account required to trigger the bypass; high integrity impact reflects DCS configuration write access; confidentiality and availability impacts are limited and secondary.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ABB).

CVSS VectorVendor: ABB

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Green

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 11, 2026 - 10:22 NVD

6.6 (MEDIUM) 5.6 (MEDIUM)

Analysis Generated

Jun 11, 2026 - 10:16 vuln.today

DescriptionCVE.org

Authentication bypass by primary weakness vulnerability in ABB Freelance.

This issue affects Freelance: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1, 2019 SP1 FP1, 2024.

AnalysisAI

Authentication bypass via primary weakness (CWE-305) in ABB Freelance DCS affects every major release line from 2013 through 2024, allowing a locally authenticated low-privilege user to circumvent the product's authentication mechanism and gain elevated control over the system. The CVSS vector (AV:L/PR:L/I:H) confirms the attacker must already hold a foothold on the host but can then achieve high integrity impact - particularly serious in an industrial control system context where manipulating controller configurations can affect physical processes. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the wide version span and OT deployment context elevate remediation urgency.

Technical ContextAI

ABB Freelance is a Distributed Control System (DCS) platform used in industrial process automation environments. The affected CPE (cpe:2.3:a:abb:freelance:*:*:*:*:*:*:*:*) spans all tracked versions through the 2024 release, indicating a pervasive architectural flaw rather than an isolated regression. CWE-305 (Authentication Bypass by Primary Weakness) describes a condition where the primary authentication mechanism itself is flawed - distinct from secondary control bypasses - meaning the intended authentication logic can be circumvented directly rather than by sidestepping a peripheral check. In an ICS/DCS context, authentication gates protect access to engineering workstations, controller configurations, function block programming, and runtime parameter adjustments; a bypass here enables actions that operators at a low-privilege tier should not be able to perform.

RemediationAI

Consult ABB's official advisory (Document ID 7PAA020361, https://search.abb.com/library/Download.aspx?DocumentID=7PAA020361&LanguageCode=en&DocumentPartId=&Action=Launch) for vendor-released patches or hotfixes - exact patched version numbers are not available in the current intelligence data and should not be inferred. While awaiting patching, restrict local access to Freelance engineering workstations to only explicitly authorized personnel by enforcing OS-level account controls and removing or disabling low-privilege accounts that do not require DCS access. Implement network segmentation to reduce the number of systems from which an attacker could pivot to a Freelance workstation. Enable audit logging for DCS configuration changes to detect unauthorized modifications even if a bypass is exploited. Note that OS-level access controls are a compensating control, not a substitute for patching, since the bypass exists within the Freelance application authentication layer itself.