CVE-2025-3465 Overview
CVE-2025-3465 is a path traversal vulnerability affecting ABB CoreSense™ HM and ABB CoreSense™ M10 condition monitoring products. The flaw, categorized under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory, allows a local attacker to access files outside the intended directory scope. The vulnerability affects CoreSense™ HM through version 2.3.1 and CoreSense™ M10 through version 1.4.1.12. Successful exploitation results in disclosure of sensitive information stored on the affected device. ABB published a security advisory describing the issue and corrective measures.
Critical Impact
Local attackers can read files outside the application's intended directory, exposing configuration data, credentials, or operational telemetry from industrial monitoring assets.
Affected Products
- ABB CoreSense™ HM through version 2.3.1
- ABB CoreSense™ M10 through version 1.4.1.12
- Industrial transformer and asset monitoring deployments using these firmware revisions
Discovery Timeline
- 2025-10-20 - CVE-2025-3465 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3465
Vulnerability Analysis
The vulnerability stems from improper validation of user-supplied path inputs within the CoreSense™ HM and CoreSense™ M10 management interfaces. The affected components fail to canonicalize and restrict file path parameters before resolving them on the file system. An attacker with local access can submit path segments containing directory traversal sequences such as ../ to escape the intended document root. This grants read access to files outside the application's permitted scope. CoreSense devices monitor electrical assets such as transformers, so the exposed data may include diagnostic logs, configuration files, and operational parameters.
Root Cause
The root cause is missing or incomplete sanitization of pathname inputs supplied to file-handling routines. The application accepts a relative or absolute path argument and concatenates it with a base directory without rejecting traversal tokens. Because the resolved path is not validated against an allowlist of permitted directories, the file system performs the read using the application's privileges. This is a classic [CWE-22] weakness manifesting in an embedded industrial product.
Attack Vector
The attack vector is local, meaning the attacker must reach the affected interface through an adjacent network path, a local console, or an authenticated session on a connected host. No user interaction or privilege is required to trigger the flaw once the interface is reachable. The impact is limited to confidentiality of files readable by the service account running the CoreSense application. The vulnerability does not directly enable code execution or data modification according to the vendor advisory.
No public exploit code or proof-of-concept has been published for CVE-2025-3465 at the time of writing. Refer to the ABB security advisory for technical details and corrective firmware versions.
Detection Methods for CVE-2025-3465
Indicators of Compromise
- Requests to CoreSense management endpoints containing ../, ..\, or URL-encoded equivalents such as %2e%2e%2f
- Unexpected file read operations referencing paths outside the CoreSense installation directory
- Access log entries showing retrieval of system files such as /etc/passwd, configuration archives, or credential stores
Detection Strategies
- Inspect web and application logs on CoreSense HM and M10 devices for path parameters containing traversal sequences or encoded variants
- Deploy network monitoring rules on operational technology (OT) segments to flag HTTP requests targeting CoreSense interfaces with suspicious path arguments
- Correlate file access auditing on the underlying operating system with CoreSense process activity to identify reads outside expected directories
Monitoring Recommendations
- Enable verbose request logging on CoreSense management interfaces and forward logs to a centralized SIEM for retention and analysis
- Baseline normal file access patterns for the CoreSense service account and alert on deviations
- Restrict and monitor administrative network access to OT subnets hosting CoreSense devices using firewall and IDS telemetry
How to Mitigate CVE-2025-3465
Immediate Actions Required
- Identify all CoreSense™ HM instances running version 2.3.1 or earlier and CoreSense™ M10 instances running 1.4.1.12 or earlier
- Restrict network access to CoreSense management interfaces to authorized engineering workstations only
- Apply the corrective firmware versions documented in the ABB security advisory
- Rotate credentials and review files that may have been exposed if compromise is suspected
Patch Information
ABB has published guidance and corrective updates for both CoreSense™ HM and CoreSense™ M10 in advisory document 3KXG200000R4801. Operators should consult ABB's documentation portal for the fixed firmware release applicable to their hardware variant and follow vendor instructions for staged deployment in production OT environments.
Workarounds
- Place CoreSense devices behind a dedicated OT firewall and permit management traffic only from a jump host
- Disable or block remote access to the management interface until firmware can be updated
- Enforce strict network segmentation between IT and OT zones following IEC 62443 zone-and-conduit guidance
- Monitor for traversal patterns at the network perimeter using intrusion detection signatures
# Configuration example: restrict CoreSense management interface to a jump host
# Replace <coresense_ip> and <jumphost_ip> with environment-specific values
iptables -A INPUT -p tcp -d <coresense_ip> --dport 443 -s <jumphost_ip> -j ACCEPT
iptables -A INPUT -p tcp -d <coresense_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
