Machine-generated analysis · WAYSCloud LLM
The advisory states that unauthenticated users can exploit a path traversal vulnerability to access restricted directories, potentially leading to full system compromise.
Context
The affected products are ABB CoreSense HM and CoreSense M10, which are used in critical infrastructure sectors including Food and Agriculture, Commercial Facilities, and Critical Manufacturing. The advisory identifies a path traversal vulnerability (CVE-2025-3465) that allows unauthenticated access to restricted directories, with exploitation potentially resulting in complete system compromise and exposure of sensitive information. The CVSS score is rated 7.1 (High) with a base vector indicating local attack vector and high confidentiality impact. ABB reports the vulnerability was corrected in CoreSense HM v2.3.4 and CoreSense M10 v1.4.1.31.
Operator considerations
- Patch: ABB has released updates (CoreSense HM v2.3.4 and CoreSense M10 v1.4.1.31) to address the vulnerability; customers are advised to apply them.
An update is available that resolves vulnerability in the product versions listed as affected in this advisory. A path traversal vulnerability in these products can allow unauthenticated users to gain access to restricted directories. Exploiting this vulnerability can lead to complete system compromise and exposure of sensitive information.
Read the full advisory on CISA →