ABB AC500 V3 Firmware Fixes Web Visualization Denial of Service
Tech GuruQuick Answer
ABB fixes CVE-2025-41738 in AC500 V3 firmware 3.9.1. A crafted request to the running web visualization server can cause denial of service. Automation Builder 2.9.1 includes the firmware, but updating the engineering workstation alone does not prove that the controller is running it.
Confirm Scope And Apply The Supported Fix
What to do now: identify controllers running older firmware and whether their web visualization server is enabled. Schedule the supported firmware change with the process owner. ABB permits disabling the web server as a workaround only when it is not needed for PLC operation.
Last verified: October 2, 2026 UTC against ABB CSAF revision 1. No controller access or operational test was performed.
Scope And Authority
| Product scope | ABB AC500 V3 PLC firmware before 3.9.1 when the web server is enabled |
|---|---|
| Advisory | 3ADR011565 |
| CVE | CVE-2025-41738 |
| Authoritative release date | 2026-09-28 00:30:00 UTC (ABB CSAF initial release); added to the ABB CSAF feed at 2026-09-28 12:10:00 UTC |
| Authority revision date | 2026-09-28 00:30:00.000 UTC |
| Affected versions | ABB AC500 V3 PLC firmware before 3.9.1 with the web visualization server enabled. |
| Fixed version | ABB AC500 V3 firmware 3.9.1, integrated into Automation Builder 2.9.1 |
| CVSS base score | 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | ABB reported no exploitation information when the advisory was initially issued; public disclosure is not evidence of exploitation. |
What Changed
The vulnerable CmpVisuServer component uses an incompatible pointer type while handling a web visualization request. ABB describes availability impact, not theft of data or code execution in this notice. A reachable but disabled web feature is not the same condition as a running vulnerable server.
What To Validate Now
- Record controller state. Capture PLC model, actual firmware, web-server configuration and operator/HMI dependencies without sending malformed requests.
- Prepare a controlled change. Preserve the application/configuration and vendor-supported recovery path. Confirm whether web visualization can be disabled without disrupting operation.
- Deploy and verify firmware. Follow the controller-specific procedure for 3.9.1 or a supported later fixed release. Read back the running controller version; an Automation Builder installer log is insufficient.
- Validate the process. In the approved operating state, check visualization, I/O and communications required by the site. Retain version and operational results; do not load-test the exploit on a production PLC.
Operational Cautions
A PLC change can interrupt control or visibility. Use the site's maintenance and safety procedures, with the process owner responsible for the allowed operating state. Network restriction is a temporary exposure control, not proof of patched firmware; disabling a required visualization service is not a harmless workaround.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
