Critical ABB Flaw (CVE-2025-10571, CVSS 9.6) Allows Unauthenticated RCE and Admin Takeover on Edgenius

ABB has issued an urgent advisory for a critical authentication bypass in the ABB Ability Edgenius Management Portal, tracked as CVE-2025-10571 with a CVSS v3.1 Base Score of 9.6, affecting versions 3.2.0.0 and 3.2.1.1. The flaw allows an unauthenticated attacker to install applications, execute arbitrary code, uninstall software, and modify configurations on affected systems, by sending a specially formed message to an Edgenius system node. It falls under CWE-288: Authentication Bypass Using an Alternate Path or Channel, meaning privileged functions can be accessed without valid credentials.

According to ABB’s summary statement, “an unauthenticated attacker could exploit this vulnerability to install and run arbitrary code, uninstall installed applications, and modify the configuration of installed applications.” ABB has released a patched version (3.2.2.0) and, for environments unable to update immediately, offers a workaround: disabling the Edgenius Management Portal will disable the vulnerable component, with no impact on day-to-day operations of an already deployed system. The article is dated 24 November 2025.