Quick answers
- Is CVE-2025-10571 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-10571 being exploited in the wild.
- How severe is CVE-2025-10571?
- Critical severity, with a CVSS score of 9.6, published 20 November 2025.
- Which products and versions are affected?
- ABB Edgenius Management Portal 3.2.0.0, 3.2.1.1.
- Is there a fix for CVE-2025-10571?
- A patch was published on 2026-04-30: Fixed in version 3.2.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-10571 attacked?
- It is attacked from the adjacent network, in a network appliance.
- Am I affected by CVE-2025-10571?
- Check whether you run ABB Edgenius Management Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authentication bypass vulnerability (CWE-288) exists in the ABB Edgenius Management Portal versions 3.2.0.0 and 3.2.1.1. The flaw allows an attacker to bypass security controls by sending specially crafted messages to the system node via an alternate path or channel. Successful exploitation requires the attacker to have network access to the environment where Edgenius is deployed while the portal is running. An attacker can achieve remote code execution (RCE), uninstall applications, and modify configurations. ABB has released a fix in Edgenius version 3.2.2.0 and recommends disabling the portal as a temporary mitigation if the update cannot be applied immediately.
Affected products
- ABB Edgenius Management Portal 3.2.0.0, 3.2.1.1
Timeline
- 2026-04-30: advisory: CISA and ABB published the advisory.
- 2026-04-30: patched: Fixed in version 3.2.2.0.