CVE-2025-6073: ABB RMC-100 Buffer Overflow Vulnerability

CVE-2025-6073 Overview

CVE-2025-6073 is a stack-based buffer overflow [CWE-121] affecting ABB RMC-100 and RMC-100 LITE remote modular controllers. The flaw resides in the device's REST interface, where the authentication broker fails to validate the length of supplied username or password fields before copying them onto the stack. When chained with CVE-2025-6074, a network-positioned attacker can overflow the credential buffer and corrupt adjacent stack memory. ABB RMC-100 firmware versions 2105457-043 through 2105457-045 and RMC-100 LITE firmware versions 2106229-015 through 2106229-016 are affected.

Critical Impact
An unauthenticated network attacker with access to the control network can trigger memory corruption on the controller, causing process disruption and denial of service to industrial operations.

Affected Products

ABB RMC-100 firmware 2105457-043 through 2105457-045
ABB RMC-100 LITE firmware 2106229-015 through 2106229-016
Deployments with the REST interface enabled and user/password broker authentication configured

Discovery Timeline

2025-07-03 - CVE-2025-6073 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-6073

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow in the REST authentication handler of the RMC-100 firmware. When user/password broker authentication is enabled, the controller accepts credentials submitted through the REST interface and copies the supplied strings into fixed-size stack buffers. The firmware does not enforce length checks on the username or password parameters before this copy operation.

Exploitation requires several preconditions to align. The REST interface must be enabled, the attacker must reach the control network, broker authentication must be active, and the related issue CVE-2025-6074 must be exploitable to bypass the preceding access path. Once these conditions are met, oversized credential strings overwrite return addresses and adjacent stack data, leading to process termination or controlled memory corruption.

Successful exploitation impacts the availability of the controller. The vulnerability does not directly expose confidentiality or integrity according to the published CVSS vector, but loss of controller availability in an industrial control system context can halt physical processes.

Root Cause

The root cause is missing bounds validation on attacker-controlled input in the REST authentication broker. The credential parsing routine uses unsafe string copy semantics into stack-allocated buffers, producing the [CWE-121] condition.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker who has gained access to the control network sends a crafted HTTP request to the REST endpoint with an oversized username or password field. Combined with the CVE-2025-6074 prerequisite, the malformed credential payload reaches the vulnerable copy routine and overflows the stack buffer.

No public proof-of-concept exploit code has been released for CVE-2025-6073, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. For protocol-level technical details and remediation specifics, refer to the ABB Security Advisory.

Detection Methods for CVE-2025-6073

Indicators of Compromise

Unexpected restarts, watchdog resets, or crash logs on RMC-100 or RMC-100 LITE controllers following inbound REST traffic
HTTP requests to the REST interface containing abnormally long username or password field values
Authentication failures originating from unauthorized hosts on the control network segment

Detection Strategies

Inspect REST authentication traffic for credential fields exceeding expected length boundaries, typically dozens of bytes
Correlate controller availability loss events with preceding HTTP POST requests to the broker authentication endpoint
Baseline normal REST API usage patterns for the RMC-100 and alert on deviations in request size, frequency, or source

Monitoring Recommendations

Enable verbose logging on network sensors covering the OT/control network segment that hosts the RMC-100 devices
Forward firewall and ICS protocol inspection logs to a central analytics platform for correlation with controller health telemetry
Track firmware versions across the controller fleet to confirm exposure scope against 2105457-043–045 and 2106229-015–016

How to Mitigate CVE-2025-6073

Immediate Actions Required

Disable the REST interface on RMC-100 and RMC-100 LITE controllers where it is not operationally required
Restrict network reachability of the controller management interfaces to a small set of authorized engineering workstations
Apply the ABB-provided firmware update that remediates both CVE-2025-6073 and the chained CVE-2025-6074
Audit broker authentication configuration and rotate credentials after patching

Patch Information

ABB has published guidance and fixed firmware for the RMC-100 product family. Operators should consult the ABB Security Advisory for the specific firmware version that supersedes 2105457-045 and 2106229-016, and follow the vendor's controlled update procedure to avoid process disruption.

Workarounds

Disable user/password broker authentication if the REST interface must remain enabled, eliminating the vulnerable code path
Segment the control network from corporate IT using a firewall that blocks all inbound HTTP traffic to controllers
Place the RMC-100 management interface behind a VPN or jump host requiring strong multi-factor authentication
Deploy ICS-aware intrusion detection to flag malformed REST requests targeting the authentication endpoint

bash

# Example firewall rule restricting REST access to engineering workstation only
iptables -A FORWARD -p tcp -d <RMC-100-IP> --dport 80 -s <ENG-WORKSTATION-IP> -j ACCEPT
iptables -A FORWARD -p tcp -d <RMC-100-IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <RMC-100-IP> --dport 443 -s <ENG-WORKSTATION-IP> -j ACCEPT
iptables -A FORWARD -p tcp -d <RMC-100-IP> --dport 443 -j DROP