Critical ABB Flaw (CVE-2025-9574, CVSS 9.9) Exposes EoL Load Controllers to Unauthenticated Admin Access

ABB emphasized that these products are end-of-life (EoL) and will not receive further security updates or vulnerability fixes. Customers relying on these devices must therefore implement network isolation and workarounds to mitigate the exposure risk.

An attacker with network access could exploit the vulnerability by connecting directly to an exposed ALS-mini controller — either through an improperly configured firewall or via malware within the same operational network.

ABB warns:

“An attacker could exploit the vulnerability by merely accessing the wrongly configured ALS-mini-S4/S8 IP controllers in the network. This would mean that the product is exposed to the public Internet, or the attacker has access to the system network.”

While no exploitation reports have been confirmed to date, ABB acknowledges that the exposure could allow complete device takeover, including unauthorized configuration changes and potential load control manipulation.

To reduce risk, ABB recommends strict network segmentation and firewall enforcement to ensure that ALS-mini devices are isolated from the public Internet and only accessible from whitelisted IP addresses.

Additional recommended controls include:

• Monitoring access attempts via IDS/IPS systems.
• Enabling alerts for connections from non-whitelisted hosts.
• Ensuring all surrounding systems are patched and hardened.

ABB also provides a simple workaround for operators not using the embedded web interface. The company notes, however, that doing so will disable remote configuration, alarm monitoring, and load status visualization, though core load control functions will remain operational.