CVE-2025-6073 ABB CVE debrief

Who should care

ABB RMC-100 and RMC-100 LITE asset owners, OT/ICS operators, control-network defenders, patch managers, and incident responders should prioritize this if REST access or broker authentication is enabled anywhere in the environment.

Technical summary

The advisory describes a buffer overflow affecting username or password handling in the broker authentication path. The issue is conditional rather than standalone: it requires user-enabled REST exposure, control-network access by an attacker, enabled user/password broker authentication, and exploitation of CVE-2025-6074. CISA assigns CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network-reachable attack conditions with a high availability impact. Affected versions are RMC-100 2105457-043 through 2105457-045 and RMC-100 LITE 2106229-015 through 2106229-016; fixed versions are RMC-100 2105457-046 and RMC-100 LITE 2106229-018.

Defensive priority

High for environments that run the affected ABB builds, especially where REST access is enabled or control-network segmentation is weak. The availability impact is high, and the vulnerability can be reached remotely within the OT control network when the stated prerequisites are met.

Recommended defensive actions

• Confirm whether any ABB RMC-100 or RMC-100 LITE devices are running affected builds 2105457-043 through 2105457-045 or 2106229-015 through 2106229-016.
• Upgrade to ABB's fixed versions: RMC-100 2105457-046 or RMC-100 LITE 2106229-018.
• If REST functionality is not required, disable it to remove one of the required preconditions.
• Restrict and segment access to the control network so only authorized systems can reach the device management surfaces.
• Review whether user/password broker authentication is enabled and minimize its use where operationally possible.
• Track and remediate CVE-2025-6074 as part of the exposure chain, since CVE-2025-6073 is described as dependent on it.
• Apply CISA and ABB ICS defense-in-depth guidance for segmentation, hardening, and least-privilege control access.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-196-02 for ABB RMC-100, which identifies the affected products, affected build ranges, and corrected versions. The advisory description explicitly states the exploit preconditions and that CVE-2025-6074 must be exploited before the buffer overflow in username or password can occur. The CVSS vector supplied in the advisory supports the network-reachable, high-availability impact assessment. The advisory revision history shows initial publication on 2025-07-03 and later republications/updates, including the 2026-05-14 update based on ABB advisory 9AKK108471A3623.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.