ABB Freelance CVE-2025-7064

Exploitation requires local access to a host running ABB Freelance - the CVSS vector AV:L confirms the attack cannot be conducted remotely over a network without first obtaining a presence on the local machine or its adjacent network segment. The attacker must hold a low-privilege account (PR:L) on the affected system; unauthenticated exploitation is not supported by the available data. The bypass targets the Freelance application's own primary authentication mechanism, meaning the host operating system's authentication is assumed to have been already satisfied. Limiting factors: an attacker without any local OS credentials cannot exploit this directly; remote-only attackers are blocked by the local attack vector; and the scope is unchanged (S:U), meaning the bypass does not inherently pivot to other systems beyond the Freelance installation itself.

The CVSS 3.1 base score of 6.6 (Medium) reflects a local-only attack vector (AV:L) and low-privilege entry requirement (PR:L), which naturally depresses the score relative to network-exploitable flaws. However, raw CVSS score understates OT-specific risk: in industrial environments, local access is often achievable via compromised engineering workstations, insider threats, or pivot from IT networks - scenarios common in ICS incidents. The high integrity impact (I:H) is the critical signal: in a DCS, integrity compromise means potential modification of setpoints, control logic, or safety interlocks, with real-world process consequences. EPSS data is not provided in available intelligence, limiting probabilistic exploitation forecasting. No KEV listing and no public POC are confirmed, suggesting exploitation has not been observed at scale. Overall: technically a medium-severity finding by CVSS, but operationally elevated risk for any Freelance deployment in a critical infrastructure or process-safety context. Version coverage spanning 2013 through 2024 means virtually all deployments are in scope - this is not a niche edge-case version.

An attacker with a low-privilege Windows or operator-tier account on a Freelance engineering workstation invokes the authentication bypass (CWE-305) to skip or satisfy the primary authentication gate without valid elevated credentials. Once bypassed, the attacker gains write access to DCS configuration, controller logic, or runtime parameters at a privilege tier they are not authorized for. No public exploit code is confirmed, so exploitation currently requires attacker knowledge of the specific bypass mechanism, but the local-access-only requirement means an insider or a threat actor already present on the OT network is the primary threat model.