CVE-2025-6074mediumCWE-321

CVE-2025-6074: medium-severity vulnerability in ABB RMC-100

Authentication Bypass to the MQTT configuration Web Interface

Published

Follow this CVE+ Monitor RMC-100+ Monitor RMC-100 LITE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.3%
Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
ABB · RMC-100ABB · RMC-100 LITE
Related CVEs — ABB RMC-100

In the same product, most dangerous first.

CVE-2025-6073HIGHStack Buffer Overflow in MQTTCoreEPSS 0.4%CVE-2025-6072HIGHStack Buffer Overflow in MQTTCoreEPSS 0.4%CVE-2025-6071MEDIUMHard Coded Key used for AES encryptionEPSS 0.3%