CVE-2025-6072: ABB RMC-100 Buffer Overflow Vulnerability

CVE-2025-6072 Overview

CVE-2025-6072 is a stack-based buffer overflow [CWE-121] affecting ABB RMC-100 and RMC-100 LITE remote modular controllers. The flaw exists in the REST interface when an attacker can reach the control network and chain exploitation with CVE-2025-6074. Attackers can submit a crafted JSON configuration that overflows the date of expiration field, corrupting stack memory on the device.

The vulnerability impacts RMC-100 firmware versions 2105457-043 through 2105457-045 and RMC-100 LITE firmware versions 2106229-015 through 2106229-016. Successful exploitation produces a high-impact availability failure on the targeted industrial controller.

Critical Impact
A network-positioned attacker can crash or destabilize ABB RMC-100 and RMC-100 LITE controllers by overflowing the JSON configuration date of expiration field, disrupting industrial process operations.

Affected Products

ABB RMC-100, firmware versions 2105457-043 through 2105457-045
ABB RMC-100 LITE, firmware versions 2106229-015 through 2106229-016
Deployments exposing the REST configuration interface on the control network

Discovery Timeline

2025-07-03 - CVE-2025-6072 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-6072

Vulnerability Analysis

The RMC-100 and RMC-100 LITE expose a REST interface for device configuration. When this interface is enabled, the controller accepts JSON payloads that include a date of expiration field. The firmware copies this field into a fixed-size stack buffer without enforcing proper length validation.

An attacker who reaches the control network and bypasses authentication through CVE-2025-6074 can submit oversized values into this field. The oversized input overflows the stack buffer and corrupts adjacent memory, including return addresses and saved registers. The resulting corruption produces device instability and process disruption on the controller.

The vulnerability requires a precondition (CVE-2025-6074 exploitation) to reach the vulnerable parser. EPSS data places exploitation probability at 0.368 percent. No public proof-of-concept code has been released, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a classic stack-based buffer overflow [CWE-121]. The JSON parsing routine handling the date of expiration field copies attacker-controlled string data into a fixed-size local stack buffer without validating input length against the destination capacity.

Attack Vector

Exploitation requires network reachability to the controller's REST interface and successful chaining with CVE-2025-6074 to bypass access controls. The attacker then issues a crafted JSON configuration request containing an overlong date of expiration value. The malformed field triggers the overflow during configuration processing.

The vulnerability mechanism is documented in ABB's security advisory. Refer to the ABB Technical Document for vendor-specific exploitation details.

Detection Methods for CVE-2025-6072

Indicators of Compromise

Unexpected reboots, watchdog resets, or crash events on RMC-100 or RMC-100 LITE controllers
HTTP POST or PUT requests to the REST configuration endpoint containing abnormally long JSON string fields
REST API traffic to controllers from hosts that are not authorized engineering workstations or SCADA servers
Configuration change events that correlate with controller availability loss

Detection Strategies

Inspect network traffic for JSON payloads sent to RMC-100 REST endpoints where field lengths exceed expected configuration sizes
Alert on REST API requests targeting the date of expiration parameter with payload sizes outside normal operational baselines
Correlate device crash events with preceding REST configuration requests using centralized log analysis
Deploy industrial protocol-aware deep packet inspection to flag malformed JSON configuration submissions

Monitoring Recommendations

Forward controller syslog, diagnostic logs, and REST access logs to a centralized SIEM for retention and correlation
Establish a baseline of normal REST configuration activity and alert on deviations in source IP, frequency, or payload size
Monitor north-south and east-west traffic crossing the control network boundary for unauthorized REST sessions
Track firmware version inventory continuously to identify devices running affected versions 2105457-043 through 2105457-045 and 2106229-015 through 2106229-016

How to Mitigate CVE-2025-6072

Immediate Actions Required

Disable the REST interface on RMC-100 and RMC-100 LITE devices where it is not operationally required
Restrict network access to controllers using firewall rules that permit only authorized engineering workstations
Apply the vendor-supplied firmware update referenced in the ABB security advisory
Audit existing controller configurations and access logs for unauthorized REST sessions

Patch Information

ABB has published guidance for affected RMC-100 and RMC-100 LITE firmware versions. Consult the ABB Technical Document for the fixed firmware release and upgrade procedure. Address CVE-2025-6074 in parallel since it is the prerequisite for exploiting CVE-2025-6072.

Workarounds

Disable the REST interface entirely on devices where remote JSON configuration is not required
Place affected controllers behind a segmented industrial DMZ with strict allowlist-based access controls
Enforce VPN or jump-host access for any remote configuration session reaching the control network
Implement application-layer filtering on industrial firewalls to reject oversized JSON fields targeting controller REST endpoints

bash

# Example firewall rule restricting REST access to authorized engineering workstation
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/28 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP