Critical ABB Alert: OPTIMAX Flaw Allows Full System Takeover

ABB has issued a critical alert over a flaw in its Ability OPTIMAX energy management system that could allow attackers to bypass authentication and take full control of affected installations, including the ability to shutdown the system, modify configurations and install arbitrary code.

The vulnerability, tracked as CVE-2025-14510, carries a CVSS v4.0 score of 9.2 and targets OPTIMAX versions 6.1, 6.2, 6.3 and 6.4 released before 20 November 2025, with patches available in later releases such as v6.4.1-251120 and v6.3.1-251120. The flaw sits in the Single-Sign On integration with Microsoft Azure Active Directory, and an attacker can impersonate a legitimate user without valid credentials.

ABB notes that affected deployments using the Azure AD SSO integration can grant the attacker the same privileges as the impersonated user, making industrial systems particularly vulnerable. A suggested workaround for organisations unable to patch immediately is to deactivate the Azure Active Directory integration and revert to OPTIMAX’s standard authentication mechanism.