ABB ALS-mini CVE-2025-9574

The attacker needs network reachability to the device's IP service on an affected ABB ALS-mini-s4 IP or ALS-mini-s8 IP unit whose serial number falls in the 2000-5166 range; per CVSS PR:N/UI:N no credentials or user interaction are required, matching the CWE-306 missing-authentication root cause. The primary limiting factor is exposure: these are specialized ABB appliances typically deployed on segmented building/industrial networks, so realistic risk hinges on whether the device is reachable from untrusted or internet-facing networks, and on the device being an in-range firmware/serial unit rather than any special non-default configuration.

All severity signals point high: the ABB-supplied CVSS 4.0 vector is 9.9 with AV:N/AC:L/PR:N/UI:N (network-reachable, low-complexity, no authentication, no user interaction), high confidentiality and integrity impact on the device (VC:H/VI:H) plus high availability impact on a subsequent/controlled system (SA:H), and ABB flagged it Automatable (AU:Y) with Urgency 'Red'. CWE-306 (Missing Authentication for Critical Function) means the barrier to abuse is essentially just network reachability. However, exploitation-likelihood signals are modest: EPSS is only 0.77% (55th percentile), there is no CISA KEV listing, and no public exploit code was provided - so this is no public exploit identified at time of analysis rather than confirmed active exploitation. The gap between the critical CVSS/Urgency and the low EPSS is best explained by the niche, non-internet-mass-market nature of these ABB building/signal devices: catastrophic for an exposed deployment, but not a broad opportunistic-scanning target. Net: a genuine high priority for organizations running these specific ABB ALS-mini units (especially if reachable from untrusted networks), but not a mass-exploitation emergency across the general internet. Note the input provides a CVSS 4.0 vector only; no CVSS 3.1 vector was supplied for cross-check.

An attacker with network access to an ABB ALS-mini-s4/s8 IP unit (serial 2000-5166) reaches a critical function that lacks any authentication check and invokes it directly, with no credentials or user interaction, to read/alter device data and manipulate the controlled system. Because ABB rates the issue automatable and network-exploitable at low complexity, a single crafted request can suffice. No public proof-of-concept was identified in the provided data.