CVE-2025-6071: ABB RMC-100 Hard-coded Key Vulnerability

CVE-2025-6071 Overview

CVE-2025-6071 is a hard-coded cryptographic key vulnerability affecting ABB RMC-100 and RMC-100 LITE remote modular controllers. These devices are used in industrial automation and oil and gas measurement applications. The flaw is classified under [CWE-321: Use of Hard-coded Cryptographic Key].

An attacker with network access can obtain salted cryptographic material and decrypt Message Queuing Telemetry Transport (MQTT) traffic exchanged by the controller. The exposure compromises the confidentiality of process telemetry sent over MQTT channels.

Critical Impact
Attackers on the network can decrypt MQTT communications from affected ABB RMC-100 devices, exposing operational telemetry and process data from industrial control environments.

Affected Products

ABB RMC-100 firmware versions 2105457-043 through 2105457-045
ABB RMC-100 LITE firmware versions 2106229-015 through 2106229-016
Deployments using MQTT for telemetry publishing on the above versions

Discovery Timeline

2025-07-03 - CVE-2025-6071 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6071

Vulnerability Analysis

The RMC-100 and RMC-100 LITE controllers embed a hard-coded cryptographic key used in the derivation of the salt applied to MQTT payload protection. Because the key is static across devices in the affected firmware range, an attacker who extracts or derives it can reproduce the salting process. Once the salt is known, the attacker can decrypt captured MQTT messages.

MQTT is a publish-subscribe protocol used in industrial IoT deployments to transport measurement, alarm, and status data. Decrypting this traffic exposes production data such as flow rates, pressures, and equipment states from field devices.

The vulnerability affects confidentiality of network communications and secondary systems that consume the MQTT stream. It does not directly enable command execution or integrity tampering according to the published vector.

Root Cause

The root cause is the embedding of a static cryptographic key inside the firmware image. Any party that acquires a device or its firmware, or reverse engineers the binary, gains permanent access to the same key that every other device uses. Hard-coded keys cannot be rotated without a firmware update, so all deployed units share the same secret until patched.

Attack Vector

The attacker requires network access to intercept MQTT traffic between the RMC-100 controller and its broker. Interception can occur through a compromised host on the operational technology (OT) network, a misconfigured broker exposed to untrusted networks, or a passive tap on the transport path. With captured ciphertext and knowledge of the hard-coded key derivation, the attacker recovers the salt and decrypts payloads offline. No authentication is required for the network-side interception, and the attack complexity is limited to obtaining the key material and traffic samples. See the ABB Technical Document PDF for vendor technical details.

Detection Methods for CVE-2025-6071

Indicators of Compromise

Unexpected MQTT subscribers connecting to brokers used by RMC-100 devices
Unusual mirror or SPAN sessions on switches carrying RMC-100 traffic
RMC-100 or RMC-100 LITE devices running firmware in the affected version ranges
Outbound MQTT sessions from the OT network to unknown external brokers

Detection Strategies

Inventory ABB RMC-100 and RMC-100 LITE firmware versions and flag devices in the vulnerable ranges
Monitor MQTT broker access logs for unauthorized client identifiers or subscriptions to controller topics
Deploy network traffic analysis on OT segments to detect passive capture indicators and rogue devices
Baseline expected MQTT publishers, subscribers, and topic hierarchies to identify anomalous consumers

Monitoring Recommendations

Log all MQTT CONNECT, SUBSCRIBE, and PUBLISH events at the broker with client identity attribution
Alert on new MAC addresses or ARP anomalies on OT VLANs carrying controller traffic
Correlate physical access logs with network events near RMC-100 field devices
Track firmware versions continuously through OT asset management tooling

How to Mitigate CVE-2025-6071

Immediate Actions Required

Identify all RMC-100 and RMC-100 LITE devices and record firmware revisions
Apply the ABB-provided firmware update that supersedes versions 2105457-045 and 2106229-016
Restrict MQTT broker exposure to trusted OT network segments only
Enforce Transport Layer Security (TLS) at the broker level to add a transport-layer confidentiality boundary

Patch Information

ABB has published guidance in the ABB Technical Document PDF. Operators should upgrade RMC-100 firmware beyond 2105457-045 and RMC-100 LITE firmware beyond 2106229-016 according to vendor instructions. Coordinate maintenance windows with process engineers before applying firmware updates to production controllers.

Workarounds

Segment RMC-100 devices onto isolated VLANs with strict access control lists between OT and IT networks
Terminate MQTT sessions inside a TLS tunnel or IPsec transport to prevent passive decryption on the wire
Disable MQTT publishing on affected devices where telemetry can be routed through alternative protected channels
Restrict physical access to controllers and network infrastructure to prevent traffic capture and firmware extraction

bash

# Configuration example: restrict MQTT broker to trusted OT subnet
iptables -A INPUT -p tcp --dport 1883 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP
iptables -A INPUT -p tcp --dport 8883 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8883 -j DROP