PT-2025-42789 · Abb · Als-Mini-S4 Ip+1

Published 2025-10-20 · Updated 2025-11-27 · CVE-2025-9574

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ABB ALS-mini-s4 IP ABB ALS-mini-s8 IP versions with Serial Number 2000 through 5166

Description A critical issue exists in ABB ALS-mini-s4 IP and ABB ALS-mini-s8 IP devices where certain critical functions can be accessed without authentication. This means that no credentials, such as passwords, are required to potentially manipulate these functions. The affected devices have Serial Numbers ranging from 2000 to 5166.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-13969

CVE-2025-9574

Affected Products

Als-Mini-S4 Ip

Als-Mini-S8 Ip

References · 13

• https://bdu.fstec.ru/vul/2025-13969 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-9574 · Security Note
• https://twitter.com/CveFindCom/status/1980320616012996761 · Twitter Post
• https://search.abb.com/library/Download.aspx?DocumentID=4TZ00000006007&LanguageCode=en&DocumentPartId=PDF&Action=Launch · Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-296-02 · Note
• https://t.me/CVEtracker/35328 · Telegram Post
• https://twitter.com/0dayPublishing/status/1980320437344088135 · Twitter Post
• https://twitter.com/CVEnew/status/1980321705412231426 · Twitter Post
• https://t.me/pentestingnews/69896 · Telegram Post
• https://twitter.com/Komodosec/status/1994183266845512005 · Twitter Post
• https://t.me/cveNotify/140140 · Telegram Post
• https://twitter.com/offseq/status/1980545636492615775 · Twitter Post
• https://twitter.com/CveTodo/status/1980325340145705429 · Twitter Post