CVE-2025-41691 ABB CVE debrief

Who should care

OT/ICS teams responsible for ABB AC500 V3 PLCs, especially environments running firmware earlier than 3.9.0, should treat this as a priority availability issue. Plant operators, control-system engineers, and asset owners should also care if remote or network-accessible communication paths exist, or if outdated clients are still used for authentication or management.

Technical summary

The source advisory describes a vulnerability in the runtime system's CmpDevice component that allows unauthenticated denial-of-service conditions through specially crafted communication requests. The failure mode is a NULL pointer dereference, and the advisory also notes impact when outdated clients attempt to log in. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, consistent with a network-reachable availability impact only. The remediation listed by the vendor is AC500 V3 firmware 3.9.0; no workaround is available.

Defensive priority

High. This is a network-reachable, unauthenticated availability issue in industrial control equipment with no workaround, so exposure should be reduced and patching should be prioritized where operationally feasible.

Recommended defensive actions

• Upgrade ABB AC500 V3 systems to firmware version 3.9.0 as soon as maintenance windows allow.
• Confirm whether the affected devices are reachable over networks that include untrusted or broad-access segments and reduce exposure where possible.
• Review whether any outdated clients are still used to log in to the affected systems and replace or update them.
• Follow the vendor's general security recommendations and CISA industrial control system defensive guidance while planning the remediation.
• Validate the firmware update path through Automation Builder 2.9.0 before deployment and schedule downtime to minimize operational risk.

Evidence notes

CISA's CSAF advisory ICSA-26-132-03, published 2026-02-24 and modified 2026-05-12, states that the runtime system's CmpDevice component can be crashed by unauthenticated specially crafted communication requests causing a NULL pointer dereference. The advisory also notes impact when outdated clients attempt to log in. Remediation is listed as AC500 V3 firmware 3.9.0, and the advisory explicitly says no workaround is available. The supplied CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The source item metadata indicates a low-confidence vendor attribution and marks the vendor field as needing review.

Official resources