Skip to content
OpenAdvisories
Critical ICSA-26-195-03 4 CVEs

ABB T-MAC Plus

Published Jun 3, 2026 · Updated Jul 14, 2026 · Revision 2

Vendor: ABB Product: T-MAC Plus

Summary

ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves the reported vulnerabilities.

An attacker who successfully exploited any of these vulnerabilities could potentially compromise the system in different ways.

Vulnerabilities 4

  • Critical 9.9
    CVE-2025-14771

    File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web Site

    Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

    ABB T-MAC Plus ICS / OT
  • High 8.8
    CVE-2025-14772

    Broken Access Control in ABB T-MAC Plus web application

    Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

    ABB T-MAC Plus ICS / OT
  • High 8.0
    CVE-2025-14773

    Stored Cross-Site Scripting in ABB T-MAC Plus web application

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

    ABB T-MAC Plus ICS / OT
  • High 7.4
    CVE-2025-14774

    Communication analysis between the Card Reader and TP2CardReaderService daemon

    Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

    ABB T-MAC Plus ICS / OT

Revision history

  1. #2

    Initial CISA Republication of ABB PSIRT 9AKK108472A7840 advisory

  2. #1

    Initial version.

References