# CVE-2025-9970: ABB LVS MConfig cleartext storage of sensitive information in memory

Source: https://junglewise.ai/threats/cve-2025-9970-abb-lvs-mconfig-cleartext-storage-of-sensitive-information-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2025-9970 · Severity: high · CVSS 7.4 · Published 2026-05-26

ABB LVS MConfig is a software tool used to configure and manage low-voltage switchgear components in industrial environments. A vulnerability in this software could allow an attacker with physical or local access to the computer running the application to extract sensitive user credentials from the system's memory. If successful, an attacker could use these credentials to modify critical equipment settings, potentially disrupting power distribution or damaging industrial hardware.

Vendors: [ABB](https://junglewise.ai/threats/vendors/abb).

## Quick answers

**Is CVE-2025-9970 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-9970 being exploited in the wild.

**How severe is CVE-2025-9970?** High severity, with a CVSS score of 7.4, published 26 May 2026.

**Which products and versions are affected?** ABB LVS MConfig <=1.4.9.21.

**Is there a fix for CVE-2025-9970?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-9970 attacked?** It is attacked with local access or with physical access, in a network appliance.

**Am I affected by CVE-2025-9970?** Check whether you run ABB LVS MConfig at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as CWE-316 (Cleartext Storage of Sensitive Information in Memory) exists in ABB LVS MConfig versions 1.4.9.21 and prior. The application fails to properly clear or encrypt authentication-related data in memory after a user logs in. An attacker with local access to the host operating system can generate a memory dump of the running process and extract plain-text passwords. Exploitation requires the attacker to have local access and for a legitimate user to be logged into the application. Once credentials are recovered, the attacker could potentially modify the configuration of motor controllers, operation panels, and protocol converters. The issue is resolved in version 1.4.9.22 by implementing SHA-256 hashing and ensuring memory is cleared after authentication.

## Affected products

- ABB LVS MConfig <=1.4.9.21

## Timeline

- 2026-05-26: advisory: CISA and ABB published the advisory.

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-06](https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-06)