CVE-2025-3756: IEC 61850 Communication Stack DoS Flaw

CVE-2025-3756 Overview

A denial-of-service vulnerability exists in the command handling of the IEC 61850 communication stack used in ABB industrial control system products. An attacker with access to IEC 61850 networks can exploit this vulnerability by sending specially crafted IEC 61850 packets, forcing communication interfaces of affected modules (PM 877, CI850, CI868) into fault mode or causing unavailability of S+ Operations 61850 connectivity.

Critical Impact

Exploitation results in denial of service affecting IEC 61850 communication functions in critical industrial control systems. While the overall availability of S+ Operations nodes remains intact, the 61850 communication functionality becomes unavailable.

Affected Products

• AC800M (System 800xA): versions 6.0.0x through 6.0.0303.0, 6.1.0x through 6.1.0031.0, 6.1.1x through 6.1.1004.0, 6.1.1x through 6.1.1202.0, 6.2.0x through 6.2.0006.0
• Symphony Plus SD Series: versions A_0, A_1, A_2.003, A_3.005, A_4.001, B_0.005
• Symphony Plus MR (Melody Rack): versions 3.10 through 3.52
• S+ Operations: versions 2.1, 2.2, 2.3, 3.3

Discovery Timeline

• 2026-04-13 - CVE CVE-2025-3756 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-3756

Vulnerability Analysis

This vulnerability stems from improper validation of input in the IEC 61850 communication stack's command handling mechanism. IEC 61850 is a widely adopted international standard for communication in electrical substation automation systems and industrial environments. The affected ABB products implement this protocol for communication between automation controllers and field devices.

When the vulnerable communication modules receive malformed IEC 61850 packets, the improper input validation (CWE-1284) causes the modules to enter a fault state. This affects communication interfaces including PM 877, CI850, and CI868 modules. Notably, the System 800xA IEC61850 Connect component is explicitly not affected by this vulnerability.

The impact is limited to the IEC 61850 communication function, meaning the overall S+ Operations node continues to function, but the critical 61850 connectivity becomes unavailable until the affected modules are recovered.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-1284) in the IEC 61850 protocol command handling implementation. The communication stack fails to properly validate incoming IEC 61850 packets before processing them, allowing malformed data to trigger fault conditions in the communication modules.

Attack Vector

Exploitation requires adjacent network access to the IEC 61850 network infrastructure. An attacker positioned on the same network segment can craft malicious IEC 61850 protocol packets designed to trigger the vulnerability. No authentication or user interaction is required to exploit this vulnerability.

The attack targets the protocol parsing and command handling components of the IEC 61850 stack. When the malformed packet is processed, it causes the communication interface to enter a fault state, disrupting industrial communication functions.

Since IEC 61850 networks are typically found in critical infrastructure environments such as electrical substations and industrial control systems, successful exploitation could impact operational technology environments. However, proper network segmentation should limit attacker access to these networks.

Detection Methods for CVE-2025-3756

Indicators of Compromise

• Unexpected fault states on PM 877, CI850, or CI868 communication modules
• Loss of IEC 61850 connectivity on S+ Operations systems without apparent network issues
• Anomalous IEC 61850 protocol traffic patterns on industrial network segments
• Repeated module fault events correlating with network traffic spikes

Detection Strategies

• Monitor IEC 61850 network traffic for malformed or unusual protocol packets using industrial protocol-aware intrusion detection systems
• Implement alerting on communication module fault events in System 800xA, Symphony Plus SD Series, Symphony Plus MR, and S+ Operations environments
• Deploy network anomaly detection on IEC 61850 network segments to identify suspicious traffic patterns
• Configure SIEM rules to correlate module fault events with network activity

Monitoring Recommendations

• Enable detailed logging on ABB industrial control system components to capture fault events
• Implement continuous monitoring of IEC 61850 communication interface health status
• Establish baseline traffic patterns for IEC 61850 networks to detect anomalies
• Monitor for repeated connection attempts or unusual packet sizes on protocol ports

How to Mitigate CVE-2025-3756

Immediate Actions Required

• Review network architecture to ensure IEC 61850 networks are properly segmented from untrusted networks
• Restrict access to IEC 61850 network segments to authorized devices and personnel only
• Implement network monitoring on industrial communication segments to detect exploitation attempts
• Consult the ABB security advisory for product-specific guidance and available patches

Patch Information

ABB has released a technical advisory addressing this vulnerability. Organizations should consult the ABB Technical Document for detailed remediation guidance and available security updates for affected product versions.

Affected organizations should prioritize updating the following components to patched versions:

• AC800M (System 800xA)
• Symphony Plus SD Series
• Symphony Plus MR (Melody Rack)
• S+ Operations

Workarounds

• Implement strict network segmentation to isolate IEC 61850 networks from general IT networks
• Apply access control lists (ACLs) on network equipment to restrict IEC 61850 traffic to known, authorized sources
• Consider deploying industrial firewalls capable of deep packet inspection of IEC 61850 protocol traffic
• Establish redundant communication paths where possible to maintain operational continuity during potential attacks

# Network segmentation verification example
# Verify IEC 61850 network isolation from corporate networks
# Check firewall rules restricting access to industrial segments
iptables -L -n | grep -i "61850"
# Review VLAN configurations for proper industrial network isolation
show vlan brief
# Verify access control lists on network switches
show access-lists