Critical ABB Flaw (CVE-2025-9574, CVSS 9.9) Exposes EoL Load Controllers to Unauthenticated Admin Access

ABB has disclosed a critical vulnerability, CVE-2025-9574, with a CVSS of 9.9, affecting its ALS-mini-S4/S8 IP intelligent load controllers used in energy management and load optimisation systems. The flaw allows unauthenticated remote attackers to access and modify device configurations via the embedded web interface, potentially disrupting power distribution or energy efficiency operations. ABB notes these products are end-of-life, meaning no security patches will be released.

The advisory explains the vulnerability lies in the embedded web server of the ALS-mini-S4/S8 IP controllers, which lacks access control, enabling an attacker to read and modify product configuration parameters without authentication. The affected range covers ALS-mini-S4 IP and ALS-mini-S8 IP controllers, with all firmware versions and serial numbers 2000–5166 for each, and the issue has a CVSS v3.1 base score of 9.1 and a CVSS v4.0 score of 9.9.

ABB recommends strict network segmentation and firewall enforcement to isolate ALS-mini devices from the public Internet, along with monitoring, alerts for non-whitelisted connections, and applying hardening measures.