{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Reid Wightman"
        ],
        "organization": "Dragos, Inc",
        "summary": "reporting the vulnerabilities through responsible disclosure."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "\u00a9 Copyright 2025 ABB. All rights reserved.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "ABB became aware of vulnerabilities in AC500 V2 listed as affected in the advisory. \nAn attacker who successfully exploited this vulnerability could access fragments of Modbus telegrams that have been sent earlier by that PLC",
        "title": "Summary"
      },
      {
        "category": "other",
        "text": "For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:\n\u2013\tIsolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).\n\u2013\tInstall physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.\n\u2013\tNever connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.\n\u2013\tScan all data imported into your environment before use to detect potential malware infections.\n\u2013\tMinimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.\n\u2013\tEnsure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.\n\u2013\tWhen remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices\n",
        "title": "General security recommendations"
      },
      {
        "category": "other",
        "text": "For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.\nInformation about ABB\u2019s cyber security program and capabilities can be found at www.abb.com/cybersecurity\n",
        "title": "Support"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.\nABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.\nThis document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.\nAll rights to registrations and trademarks reside with their respective owners.\n",
        "title": "Notice"
      },
      {
        "category": "general",
        "text": "Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed.\nRegarding this vulnerability it is recommended to\n\n\u2022\tDo not use the Modbus server for sending any sensitive data, as fragments might be accessible even after the initial sending of the response\n\n\n\u2022\tOnly use supported Modbus function codes, as invalid responses to unsupported function codes might have negative effects on the requesting Modbus client.\nRefer to section \u201cGeneral security recommendations\u201d for further advise on how to keep your system secure.\n",
        "title": "Mitigating factors"
      }
    ],
    "publisher": {
      "category": "vendor",
      "name": "ABB PSIRT",
      "namespace": "https://global.abb/group/en/technology/cyber-security/alerts-and-notifications"
    },
    "references": [
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - PDF version ",
        "url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011432\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
      },
      {
        "category": "self",
        "summary": "ABB CYBERSECURITY ADVISORY - CSAF version ",
        "url": "https://psirt.abb.com/csaf/2025/3adr011432.json"
      }
    ],
    "title": "AC500 V2 Buffer overread on Modbus protocol",
    "tracking": {
      "current_release_date": "2025-07-23T00:30:00.000Z",
      "generator": {
        "date": "2025-09-23T12:16:11.657Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.35"
        }
      },
      "id": "3ADR011432",
      "initial_release_date": "2025-07-23T00:30:00.000Z",
      "revision_history": [
        {
          "date": "2025-07-23T00:30:00.000Z",
          "legacy_version": "A",
          "number": "1",
          "summary": "Initial version. "
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=2.5.2",
                "product": {
                  "name": "AC500 V2 version \u003c=2.5.2",
                  "product_id": "AV1"
                }
              },
              {
                "category": "product_version",
                "name": "\u202f2.5.3",
                "product": {
                  "name": " AC500 V2\u202f\u003e=\u202f2.5.3",
                  "product_id": "FX1"
                }
              }
            ],
            "category": "product_name",
            "name": "AC500 V2"
          }
        ],
        "category": "vendor",
        "name": "ABB"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-7745",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "description",
          "text": "Sending unsupported function codes to the AC500 V2 Modbus server might result in invalid responses. Fragments of previous responses might be added to the end of the response.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "fixed": [
          "FX1"
        ],
        "known_affected": [
          "AV1"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "NVD - CVE-2025-7745",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7745"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "The vulnerabilities have been resolved in the following product versions:\nAC500 V2 firmware version 2.5.3 (released in 2016) and later",
          "product_ids": [
            "AV1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.8,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "temporalScore": 5.8,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AV1"
          ]
        }
      ],
      "title": "CVE-2025-7745"
    }
  ]
}