ABB T-MAC Plus flaws risk terminal system compromise
ABB patched four vulnerabilities in T-MAC Plus terminal management software allowing file disclosure, privilege escalation, stored XSS, and a DoS against card readers.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
ABB disclosed four vulnerabilities affecting T-MAC Plus version 4.0-24, a Terminal Management System used to control operations such as product receipt/dispatch, access control, and tank farm movements at chemical, petroleum, pipeline, and hydrogen terminals worldwide. The flaws stem from IIS server misconfiguration enabling file browsing, improper privilege separation between user roles, a DOM-based stored XSS in the web application, and an unencrypted communication protocol with card readers that can be disrupted via a crafted message if an attacker gains physical access to a serial device.
Exploitation generally requires authenticated access (file disclosure, privilege escalation, XSS) or physical network/device access (the card reader DoS), and ABB states it has not received reports of in-the-wild exploitation. The vendor has released version 4.0-25 to remediate all four issues and corrected the underlying IIS misconfigurations and privilege assignments. CISA republished the advisory and recommends standard ICS network segmentation, minimizing internet exposure, and using secure remote access methods such as VPNs as compensating controls until the update is applied.
Given the product's deployment in critical manufacturing and energy-adjacent terminal operations (petroleum, pipeline, chemical, hydrogen), successful exploitation could expose sensitive operational data, allow unauthorized administrative actions, or disrupt physical access-control/card reader services. The vulnerabilities were responsibly disclosed by a researcher via Italy's national cybersecurity agency (ACN), and no public exploit code or active campaign has been reported.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-03
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs