Missing Authentication Vulnerability in ABB ALS-mini S4 and S8 IP Products
CVE-2025-9574

9.9CRITICAL

Key Information:

Vendor

Abb

Status
Als-mini-s4 Ip
Als-mini-s8 Ip
Vendor
CVE Published:
20 October 2025

What is CVE-2025-9574?

A vulnerability exists in ABB's ALS-mini S4 and ALS-mini S8 IP products due to missing authentication for critical functions. This flaw potentially allows unauthorized users to access sensitive functions and perform operations that could compromise the integrity and security of the devices. All firmware versions with Serial Numbers ranging from 2000 to 5166 are affected. It is imperative for users to review their configurations to mitigate risks associated with this issue.

Affected Version(s)

ALS-mini-s4 IP 0

ALS-mini-s8 IP 0

References

https://search.abb.com/library/Download.aspx?DocumentID=4...

CVSS V4

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ABB acknowledges Souvik Kandar of MicroSec (microsec.io), for reporting vulnerabilities in responsible disclosure.
JSON
.
CVE-2025-9574 : Missing Authentication Vulnerability in ABB ALS-mini S4 and S8 IP Products