ABB T-MAC Plus EUVD-2025-210047

Attacker must have adjacent-network reachability to the T-MAC Plus device (AV:A) - same VLAN, same physical Layer-2 segment, or same local broadcast/wireless domain as the device, not arbitrary internet routability. No authentication and no user interaction are required (PR:N/UI:N) and attack complexity is low (AC:L), but CVSS 4.0 Attack Requirements are Present (AT:P), meaning ABB has signaled that some additional environmental or configuration precondition must be satisfied which the public description does not enumerate - defenders should consult the vendor advisory for the specific deployment mode or feature state required. Exploitation is naturally limited to environments where the T-MAC Plus runs firmware 4.0-24 and where OT segmentation does not already prevent untrusted hosts from reaching the device.

The CVSS 4.0 vector tells a nuanced story: PR:N/UI:N/AC:L means the bug itself is trivial to trigger with no credentials and no user interaction, but AV:A and AT:P (Attack Requirements: Present) confine exploitation to attackers already on the adjacent network segment with some additional preconditions the vendor has not detailed publicly. Impact is asymmetric - no confidentiality loss (VC:N) but high integrity and availability impact on both the vulnerable component and downstream subsequent systems (VI:H/VA:H/SI:H/SA:H), which is characteristic of ICS authorization bugs that let an attacker issue commands or alter device state. There is no CISA KEV listing, no EPSS score in the provided data, and no public exploit identified at time of analysis, so real-world urgency is driven primarily by operational exposure (how segmented the OT network is) rather than evidence of opportunistic mass exploitation. Note that the description and CVSS vector together imply OT-adjacent positioning rather than internet-wide reachability - defenders should verify deployment topology before triaging this as remote-network-exposed.

An attacker who has obtained a foothold on the same OT network segment as a T-MAC Plus device - for example via a compromised engineering workstation, an unsecured wireless bridge, or physical access to a field cabinet - sends a crafted request that the device's authorization logic incorrectly accepts. The attacker then issues commands that alter device configuration or measurement state (high integrity impact) or disrupts the device's operation (high availability impact), with potential cascading effects on the industrial process the device feeds (SI:H/SA:H). No public exploit identified at time of analysis, so the attacker would need to develop the request based on the ABB advisory or reverse engineering.