CVE-2025-14771: ABB T-MAC Plus Information Disclosure Flaw

CVE-2025-14771 Overview

CVE-2025-14771 is a files or directories accessible to external parties vulnerability affecting ABB T-MAC Plus version 4.0-24. The flaw maps to [CWE-552], which describes resources unintentionally exposed to unauthorized actors. An attacker with low privileges and network access can reach files or directories that should remain restricted to internal users. Successful exploitation can lead to disclosure of sensitive operational data and impact the integrity and availability of the device.

Critical Impact
Network-reachable attackers with low privileges can access restricted files on ABB T-MAC Plus 4.0-24, exposing sensitive industrial system data.

Affected Products

ABB T-MAC Plus 4.0-24

Discovery Timeline

2026-06-03 - CVE-2025-14771 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2025-14771

Vulnerability Analysis

The vulnerability resides in ABB T-MAC Plus version 4.0-24. The product exposes files or directories to external parties that should remain inaccessible. An authenticated attacker with low privileges can reach this exposed content over the network without user interaction. The exposure affects confidentiality of system data and can also impact integrity and availability of the device, including downstream subsequent systems that trust its outputs.

T-MAC Plus is part of ABB's industrial measurement and control product line, where exposed configuration, log, or process data can reveal credentials, calibration parameters, or operational state. Disclosure of such files provides reconnaissance value for follow-on attacks against connected operational technology environments.

Root Cause

The root cause is improper restriction of file or directory access, classified under [CWE-552] (Files or Directories Accessible to External Parties). The product fails to enforce adequate access controls on resources reachable through its network interfaces. Files intended for internal use are served to any authenticated requester regardless of authorization scope.

Attack Vector

The attack vector is network-based. An adversary requires low privileges on the target and does not require user interaction. The attacker connects to the exposed service and requests files or directory listings that should be restricted. See the ABB security advisory for vendor technical details.

Detection Methods for CVE-2025-14771

Indicators of Compromise

Unexpected authenticated sessions to ABB T-MAC Plus devices from non-engineering workstations or external network segments.
Anomalous file or directory enumeration requests against T-MAC Plus management interfaces.
Outbound transfers of configuration, log, or data files from T-MAC Plus devices to unfamiliar destinations.

Detection Strategies

Inventory all ABB T-MAC Plus assets and confirm firmware version, flagging any instance running 4.0-24.
Inspect network logs for repeated requests targeting file paths or directory indexes on T-MAC Plus endpoints.
Correlate authentication events with file access patterns to identify low-privileged accounts retrieving content outside their normal scope.

Monitoring Recommendations

Enable verbose access logging on T-MAC Plus devices and forward logs to a centralized SIEM for retention and analysis.
Apply network segmentation monitoring to detect any IT-to-OT traffic reaching T-MAC Plus management interfaces.
Baseline normal user and service activity, then alert on deviations indicating reconnaissance or bulk file retrieval.

How to Mitigate CVE-2025-14771

Immediate Actions Required

Identify and inventory all ABB T-MAC Plus 4.0-24 deployments across operational technology and engineering networks.
Restrict network access to T-MAC Plus management interfaces using firewalls and VLAN segmentation, allowing only authorized engineering hosts.
Review and reduce account privileges on T-MAC Plus, removing unused accounts and enforcing least privilege.
Apply vendor-provided updates or guidance as described in the ABB security advisory.

Patch Information

ABB has published a security advisory for T-MAC Plus addressing this vulnerability. Refer to the ABB documentation portal for the latest firmware, remediation guidance, and configuration recommendations. Apply the vendor's fixed version to affected devices as soon as operationally feasible.

Workarounds

Place T-MAC Plus devices behind a dedicated firewall and block all inbound traffic except from explicitly authorized engineering workstations.
Disable or restrict any unused network services on the device to reduce exposed attack surface.
Rotate credentials for all accounts on T-MAC Plus, particularly low-privilege accounts that could be abused for file access.
Continuously monitor file access and authentication logs until the vendor patch is deployed and verified.

bash

# Example firewall rule restricting T-MAC Plus access to engineering subnet only
iptables -A INPUT -p tcp -s 10.10.20.0/24 -d <tmac_plus_ip> --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -d <tmac_plus_ip> --dport 443 -j DROP