AI Summary

ABB disclosed a stack‑buffer overflow vulnerability (CVE‑2025‑15467) in its AC500 V3 controllers, specifically in versions 3.9.0 and 3.9.0_HF1. The flaw occurs when parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES‑GCM; the initialization vector from ASN.1 parameters is copied into a fixed‑size stack buffer without length validation. Exploitation could cause a crash, denial‑of‑service, or potentially allow remote code execution. The vulnerability affects critical infrastructure sectors including chemical, manufacturing, energy, and water/wastewater worldwide. ABB has released an update that resolves the publicly reported issue.

AI summaries can be wrong sometimes—always verify important details using the source article.