ICSA-25-196-02: ABB RMC-100 (Update A)

Summary

ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could gain unauthenticated access to the MQTT configu-ration data (CVE-2025-6074), cause a DoS on the MQTT configuration web server (REST interface) (CVE-2025-6073, CVE-2025-6072), or decrypt encrypted MQTT broker credentials (CVE-2025-6071). CVE-2025-6074: When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data. CVE-2025-6073: When the REST interface is enabled by the user, and an attacker gains access to the control network, and user/password broker authentication is enabled, and CVE-2025-6074 is exploited, the attacker can overflow the buffer for username or password. CVE-2025-6072: When the REST interface is enabled by the user, and an attacker gains access to the control network, and CVE-2025-6074 is exploited, the attacker can use the JSON configuration to overflow the date of expiration field. CVE-2025-6071: Attacker can gain access to salted information to decrypt MQTT information.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSA-25-196-02
Status: Final · version 4
Initial release: 2025-07-03
Last revised: 2026-05-14 (4 revisions)
Vendor: ABB
Critical infrastructure sectors: Critical Manufacturing
Deployed: Worldwide
Vendor headquarters: Switzerland

Republished vendor advisory. This ICSA is a verbatim republication of ABB 9AKK108471A3623 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not…

Mitigating factors: ABB recommends disabling the REST interface when not being used to configure the MQTT functionality. By default, the REST interface is disabled so no risk is present. The RMC-100 is not intended for access over public networks such as the internet. An attacker would need to have access to the customer’s private control network to exploit this vulnerability. Proper network segmentation is recommended. Refer to section “General security recommendations” for further advise on how to keep your system secure.

Credit: Vera Mens (Claroty Team82)

Affected products (2)

RMC-100 — >=2105457-043|<=2105457-045, 2105457-046
RMC-100 LITE — >=2106229-015|<=2106229-016, 2106229-018

Revision history (4)

2026-05-14 — v4: CISA Republication update based on ABB 9AKK108471A3623 advisory
2025-08-18 — v3: Added information on the software customer packages that correct the reported issue.
2025-07-15 — v2: CISA Republication - Initial Publication
2025-07-03 — v1: Initial version.

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2025-6072	CWE-121 Stack-based Buffer Overflow	7.5 High	CVE-2025-6072 When the REST interface is enabled by the user, and an attacker gains access to the control network, and CVE-2025-6074 is exploited, the attacker can use the JSON configuration to overflow the date of expiration field. Vendor fix: The problem is corrected in RMC-100 version (2105457-046) and RMC-100 LITE version (2106229-018) Affected, fixed & timeline Affected: RMC-100 >=2105457-043\|<=2105457-045 RMC-100 LITE >=2106229-015\|<=2106229-016 Fixed in: RMC-100 2105457-046 RMC-100 LITE 2106229-018
CVE-2025-6073	CWE-121 Stack-based Buffer Overflow	7.5 High	CVE-2025-6073 When the REST interface is enabled by the user, and an attacker gains access to the control network, and user/password broker authentication is enabled, and CVE-2025-6074 is exploited, the attacker can overflow the buffer for username or password. Vendor fix: The problem is corrected in RMC-100 version (2105457-046) and RMC-100 LITE version (2106229-018) Affected, fixed & timeline Affected: RMC-100 >=2105457-043\|<=2105457-045 RMC-100 LITE >=2106229-015\|<=2106229-016 Fixed in: RMC-100 2105457-046 RMC-100 LITE 2106229-018
CVE-2025-6074	CWE-321 Use of Hard-coded Cryptographic Key	6.5 Medium	CVE-2025-6074 When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data. Vendor fix: The problem is corrected in RMC-100 version (2105457-046) and RMC-100 LITE version (2106229-018) Affected, fixed & timeline Affected: RMC-100 >=2105457-043\|<=2105457-045 RMC-100 LITE >=2106229-015\|<=2106229-016 Fixed in: RMC-100 2105457-046 RMC-100 LITE 2106229-018
CVE-2025-6071	CWE-321 Use of Hard-coded Cryptographic Key	5.3 Medium	CVE-2025-6071 Attacker can gain access to salted information to decrypt MQTT information. Vendor fix: The problem is corrected in RMC-100 version (2105457-046) and RMC-100 LITE version (2106229-018) Affected, fixed & timeline Affected: RMC-100 >=2105457-043\|<=2105457-045 RMC-100 LITE >=2106229-015\|<=2106229-016 Fixed in: RMC-100 2105457-046 RMC-100 LITE 2106229-018

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2025-6072	8.2 High	ABB RMC-100 Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains …
CVE-2025-6073	8.2 High	ABB RMC-100 Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains ac…
CVE-2025-6071	6.3 Medium	ABB RMC-100 Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to decrypt MQ…
CVE-2025-6074	6.3 Medium	ABB RMC-100 Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacke…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.

CyberzSOC