CVE-2025-53187: Critical RCE in ABB ASPECT BMS with CVSS 9.8, No Prior Authentication

CVE-2025-53187 is described as a critical RCE and authentication bypass in ABB ASPECT BMS, with a CVSS of 9.8 and no prior authentication required. ABB has stated that three major vulnerabilities affect ASPECT firmware versions prior to 3.08.04-s01, with the authentication bypass arising from a debugging code left in the market release that allows bypassing authentication.

According to ABB, an attacker could change the system time, access files, and perform function calls that equate to remote code execution without needing to log in. Although no exploitation has been observed, ABB warns that misconfigured systems exposed to the internet are at risk and that successful exploitation could affect confidentiality, integrity and availability of system data.

The advisory urges immediate protective actions, including disconnecting exposed systems, upgrading to firmware version 3.08.04-s01 or later, and applying robust access controls and VPNs for remote connectivity. The article notes that ASPECT is widely deployed on‑premise but not intended to be internet-facing, and emphasises the importance of changing default credentials as part of commissioning. 5 September 2025.