# CVE-2025-41659: ABB AC500 V3 Multiple Vulnerabilities in PLC Firmware

Source: https://junglewise.ai/threats/cve-2025-2595-abb-ac500-v3-multiple-vulnerabilities-in-plc-firmware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-41659 · Severity: high · CVSS 8.3 · Published 2026-05-12

ABB AC500 V3 programmable logic controllers (PLCs), used widely in critical infrastructure like energy and manufacturing, are affected by multiple security flaws. These vulnerabilities could allow an attacker to crash the controller, bypass security logins to view interface files, or gain unauthorized access to digital certificates and encryption keys. Exploitation could lead to operational downtime or the compromise of secure communications within the industrial network.

Vendors: [ABB](https://junglewise.ai/threats/vendors/abb).

## Quick answers

**Is CVE-2025-41659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-41659 being exploited in the wild.

**How severe is CVE-2025-41659?** High severity, with a CVSS score of 8.3, published 12 May 2026.

**Which products and versions are affected?** ABB AC500 V3 PLC firmware < 3.9.0.

**Is there a fix for CVE-2025-41659?** A patch was published on 2026-05-12: Firmware version 3.9.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-41659 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-41659?** Check whether you run ABB AC500 V3 PLC firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ABB AC500 V3 firmware versions prior to 3.9.0 contain three distinct vulnerabilities. CVE-2025-2595 is a forced browsing flaw (CWE-425) allowing unauthenticated remote attackers to bypass user management and access static visualization files. CVE-2025-41659 involves incorrect permission assignment (CWE-732) in the CmpOpenSSL component, allowing low-privileged users to read or write PKI certificates and keys via the CODESYS protocol. CVE-2025-41691 is a NULL pointer dereference (CWE-476) in the CmpDevice component that allows unauthenticated attackers to trigger a denial-of-service (DoS) state through specially crafted communication requests. These issues are resolved in firmware version 3.9.0.

## Affected products

- ABB AC500 V3 PLC firmware < 3.9.0

## Identifiers

- CVE-2025-41659
- CVE-2025-41691
- CVE-2025-2595

## Timeline

- 2026-05-12: advisory: CISA ICSA-26-132-03 published
- 2026-05-12: patched: Firmware version 3.9.0 released

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-03](https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-03)