Three Flaws, One PLC Line: ABB’s AC500 V3 Patch Closes a Dangerous OT Triangle

Industrial controllers rarely fail in just one place. In this case, the risk spans three layers at once: browser-facing visualization, cryptographic trust material, and runtime availability. For operators of ABB AC500 V3 PLCs, that matters because each layer serves a different purpose, yet all of them can be reached across the network in the wrong deployment.

Fast Facts

• ABB AC500 V3 PLCs are affected by three vulnerabilities tracked as CVE-2025-2595, CVE-2025-41659, and CVE-2025-41691.
• ABB says firmware version 3.9.0 corrects the issues and is available through Automation Builder 2.9.0.
• No workaround is available in lieu of the firmware update.
• The advisory lists affected sectors including chemical, critical manufacturing, energy, and water and wastewater.
• ABB had not received reports of exploitation when the advisory was originally issued.

What the vulnerabilities change

CVE-2025-2595 is the most “quiet” of the three, but not harmless: an unauthenticated remote attacker can bypass user management and read visualization files through forced browsing. Those files are described as static assets such as text lists, icons, or images, not live process data. Even so, static assets can still help an intruder map the interface and understand how an operator views the system.

CVE-2025-41659 is more sensitive. It affects systems using the optional CmpOpenSSL component and lets low-privileged remote attackers access the PKI folder via the CODESYS protocol, with read and write access to certificates and keys. That creates a trust problem, not just a data-access problem: certificate-based encryption and signing features may be affected, and unauthorized certificates could be trusted if local handling is weak.

CVE-2025-41691 hits availability. A specially crafted communication request can trigger a NULL pointer dereference in the runtime’s CmpDevice component and cause a denial-of-service. The advisory also notes that outdated clients attempting to log in can hit the same path, which is a reminder that old tooling can become part of the attack surface.

The practical lesson is straightforward: in PLC environments, a “minor” web issue, a crypto permission issue, and a crash bug can sit inside the same firmware image and still create distinct operational hazards. At the time of writing, public information supports a risk analysis, not a definitive claim about broader compromise.

Defensive takeaway

The safest response is also the least glamorous: move to AC500 V3 firmware 3.9.0, keep control devices off the public internet, isolate them behind firewalls, and reduce exposed ports to the minimum needed for operations. Where certificate-based functions are in use, operators should also review trust stores, issued certificates, and any dependencies on the affected runtime path.

This is what modern OT security looks like: not one bug, but a chain of small trust failures that can turn into real operational risk if they are left on the network too long.

TECHCROOK

Industrial firewall appliance: A dedicated firewall can help segment PLCs and other OT devices from the wider network, limit exposed services, and enforce tighter access rules between control zones. For small facilities, a compact hardware firewall or router with VLAN support is often a practical step toward reducing unnecessary network reachability.

Scheda Techcrook: Industrial firewall appliance

WIKICROOK

• PLC: A programmable logic controller used to automate industrial equipment and processes.
• Forced Browsing: A web access flaw where a user can reach protected resources by requesting them directly.
• PKI: Public Key Infrastructure, the system used to manage digital certificates and cryptographic keys.
• NULL Pointer Dereference: A software error that can crash a program when it tries to use an empty memory reference.
• Firmware: Low-level device software that controls hardware behavior and core runtime functions.