ABB reports high-severity vulnerabilities in automation products

ABB has reported three high-severity vulnerabilities affecting several of its industrial automation products. These flaws could allow attackers to execute arbitrary code, cause denial of service (DoS), or escalate privileges to gain control over affected systems.

Specifically, the vulnerabilities impact ABB Automation Builder (versions prior to 2.9.1), AC500 V3 products (firmware prior to 3.9.1), and the ABB Protection and Control IED Manager PCM600 (versions 2.14 and earlier). One identified flaw, CVE-2025-41700, involves untrusted data deserialization in the Automation Builder print engine, which could allow an unauthenticated attacker to execute code via a manipulated project file.

ABB recommends updating Automation Builder to version 2.9.1 and updating AC500 V3 firmware to version 3.9.1. For the PCM600 software, which currently lacks a direct update, ABB suggests a mitigation strategy involving the configuration of the ABBPCMSchedulerService to run under the same Windows account used for PCM600.