ABB LVS MConfig memory dump credential exposure
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
ABB MConfig versions up to 1.4.9.21 leak plaintext credentials via memory dumps; requires local access to exploit.
ABB has disclosed CVE-2025-9970, a credential exposure vulnerability in LVS MConfig (parameterizing software for ABB low-voltage switchgear controllers) affecting versions 1.4.9.21 and earlier. The vulnerability allows an attacker with local access to the host machine to export memory dumps during runtime, potentially extracting plaintext passwords and other sensitive information stored in application memory. An attacker exploiting this would need physical access to the machine running MConfig, plus post-login access to trigger the dump—a moderate bar but plausible in managed industrial environments where physical security may be inconsistent.
The impact is significant for critical infrastructure: successful exploitation could allow an attacker with stolen credentials to modify switchgear component settings, potentially compromising operation of motor controllers, feeder controllers, and other LV distribution equipment. The vulnerability affects deployments worldwide across chemical, manufacturing, energy, food and agriculture, transportation, and water/wastewater sectors. ABB has released MConfig version 1.4.9.22, which clears authentication-related memory after login and switches to SHA256 password hashing. No evidence of active exploitation in the wild is documented in this advisory; this is vendor-initiated disclosure. Defenders should prioritize patching in environments with physical-access controls that may be weak, and restrict MConfig host access to authorized personnel only.
Mentioned in this report
Detection guidance
Memory Dump Tool Targeting MConfig Process
Detects procdump, createdump or comsvcs MiniDump invoked with MConfig on the command line, indicating a runtime memory dump of the ABB LVS MConfig process. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Memory Dump Tool Targeting MConfig Process
description: Detects memory dumping utilities (procdump, createdump, comsvcs.dll MiniDump)
invoked with a reference to MConfig by name, consistent with dumping ABB LVS MConfig
process memory to recover plaintext credentials (CVE-2025-9970). Dumps requested
by PID will not match and are covered by the process_access and file_event rules.
tags:
- attack.collection
- attack.t1005
- attack.credential-access
logsource:
category: process_creation
product: windows
detection:
selection_target:
CommandLine|contains: mconfig
selection_tool_exe:
Image|endswith:
- \procdump.exe
- \procdump64.exe
- \createdump.exe
selection_tool_comsvcs:
CommandLine|contains|all:
- comsvcs
- MiniDump
condition: selection_target and 1 of selection_tool_*
falsepositives:
- Engineers or vendor support collecting a crash dump of MConfig for troubleshooting
- Authorised diagnostics tooling run by IT on the engineering workstation
level: high
id: 956b9824-cf9d-5be8-9a4c-02cd4d918988
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-06
MConfig Process Memory Dump File Created
Detects creation of a .dmp file named after MConfig, for example from Task Manager's Create dump file action or a dump utility. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MConfig Process Memory Dump File Created
description: Detects creation of a memory dump file whose name references MConfig
(ABB LVS MConfig). Task Manager and most dump tools name the file after the process,
so this catches runtime memory exports that may contain plaintext credentials (CVE-2025-9970).
tags:
- attack.collection
- attack.t1005
- attack.credential-access
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: mconfig
TargetFilename|endswith:
- .dmp
- .dump
condition: selection
falsepositives:
- Windows Error Reporting writing a crash dump after an MConfig application crash
- Vendor-guided troubleshooting that exports a dump on purpose
level: medium
id: 808ea844-82cf-55c7-9eba-e31a3b98f54f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-06
Suspicious Process Access to MConfig With Dump-Capable Rights
Detects a non-system process opening the MConfig process with memory-read access rights typical of credential or memory dumping. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Process Access to MConfig With Dump-Capable Rights
description: Detects a process opening an MConfig process with access masks that allow
reading memory (as used by dump tools and Task Manager), consistent with extracting
plaintext credentials from ABB LVS MConfig memory (CVE-2025-9970). Requires Sysmon
process access telemetry.
tags:
- attack.collection
- attack.t1005
- attack.credential-access
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|contains: mconfig
GrantedAccess:
- '0x1FFFFF'
- '0x1F3FFF'
- '0x1410'
- '0x1438'
- '0x143A'
- '0x1010'
filter_system:
SourceImage|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Program Files\Windows Defender\
- C:\ProgramData\Microsoft\Windows Defender\
filter_self:
SourceImage|contains: mconfig
condition: selection and not filter_system and not filter_self
falsepositives:
- Endpoint security or EDR agents scanning the MConfig process
- Task Manager or Resource Monitor used by an administrator, depending on the filter
tuning
level: medium
id: cfd4fccb-3577-551e-8561-c918ab5fbad9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-06
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-06
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs