CVE-2025-6071 ABB CVE debrief

Who should care

Industrial control system operators using ABB RMC-100 or RMC-100 LITE, especially teams that manage device firmware, MQTT-connected deployments, and OT network segmentation.

Technical summary

CISA’s advisory for ICSA-25-196-02 identifies affected ABB RMC-100 versions 2105457-043 through 2105457-045 and RMC-100 LITE versions 2106229-015 through 2106229-016. The issue is rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating network exposure with low confidentiality impact and no integrity or availability impact listed in the vector. The remediation listed by ABB is RMC-100 version 2105457-046 and RMC-100 LITE version 2106229-018. The source timeline shows an initial publication on 2025-07-03 and a later CISA republication update on 2026-05-14 based on ABB’s advisory.

Defensive priority

Medium. The issue is remotely reachable and affects OT equipment, but the published impact is limited to confidentiality. Patch planning should still be prompt for any exposed or MQTT-dependent deployments.

Recommended defensive actions

• Upgrade ABB RMC-100 to version 2105457-046 or later.
• Upgrade ABB RMC-100 LITE to version 2106229-018 or later.
• Inventory deployed RMC-100 and RMC-100 LITE units to confirm whether affected build ranges are present.
• Prioritize remediation on systems that exchange MQTT data or are reachable from less-trusted network segments.
• Review OT network segmentation and access controls around devices that handle MQTT traffic.
• Use the vendor and CISA advisory references to verify package versions before and after maintenance windows.

Evidence notes

Source evidence comes from the CISA CSAF advisory ICSA-25-196-02 for ABB RMC-100, with supporting ABB advisory references and official CVE/NVD records. The advisory states the issue is that an attacker can gain access to salted information to decrypt MQTT information. CISA metadata lists affected product versions as RMC-100 2105457-043 through 2105457-045 and RMC-100 LITE 2106229-015 through 2106229-016, with fixes in 2105457-046 and 2106229-018. The CVSS vector supplied in the source is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The advisory was first published on 2025-07-03 and republished with an update on 2026-05-14. No KEV listing or ransomware campaign association is indicated in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.