CVE-2025-6072— Stack Buffer Overflow in MQTTCore
Quick assessment
Affected
ABB RMC-100
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ABB RMC-100是瑞士ABB公司的一个远程模块化控制器。能够管理自动化、液体和气体测量，大型生产和传输设施的资产数据集中。 ABB RMC-100存在安全漏洞，该漏洞源于栈缓冲区溢出，可能导致执行任意代码。以下版本受到影响：ABB RMC-100 2105457-045及之前版本和ABB RMC-100 LITE 2106229-016及之前版本。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-6072
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stack Buffer Overflow in MQTTCore
Source: CVE Program / CVE List V5
Vulnerability Description
Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE.
When the REST interface is enabled by the user, and an attacker gains access to
the control network, and CVE-2025-6074 is exploited, the attacker can use the
JSON configuration to overflow the date of expiration field.This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
ABB RMC-100 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ABB RMC-100是瑞士ABB公司的一个远程模块化控制器。能够管理自动化、液体和气体测量，大型生产和传输设施的资产数据集中。 ABB RMC-100存在安全漏洞，该漏洞源于栈缓冲区溢出，可能导致执行任意代码。以下版本受到影响：ABB RMC-100 2105457-045及之前版本和ABB RMC-100 LITE 2106229-016及之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ABB | RMC-100 | 2105457-043 ~ 2105457-045 | - |
|
| ABB | RMC-100 LITE | 2106229-015 ~ 2106229-016 | - |
|
II. Public POCs for CVE-2025-6072
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-6072
请登录查看更多情报信息。
Same Patch Batch · ABB · 2025-07-03 · 4 CVEs total
| CVE-2025-6073 | 7.5 HIGH | Stack Buffer Overflow in MQTTCore |
| CVE-2025-6074 | 6.5 MEDIUM | Authentication Bypass to the MQTT configuration Web Interface |
| CVE-2025-6071 | 5.3 MEDIUM | Hard Coded Key used for AES encryption |
IV. Related Vulnerabilities
Same vendor: ABB
-
CVE-2026-12705
Integrity mechanism of KNX-device FW-files can be bypassed i -
CVE-2025-13162
Advant Master Online Builder DLL vulnerability -
CVE-2025-7064
Freelance Security Lock – Access to Windows OS -
CVE-2025-14774
Communication analysis between the Card Reader and TP2CardRe -
CVE-2025-14773
Stored Cross-Site Scripting in ABB T-MAC Plus web applicatio
Same weakness: CWE-121
-
CVE-2026-77658
Dia: dia: stack buffer overflow in bus object via unvalidate -
CVE-2026-79911
TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based o -
CVE-2026-78910
Chrome < 152.0.7977.65 V8缓冲区溢出远程代码执行漏洞 -
CVE-2026-48417
Substance3D - Sampler | Stack-based Buffer Overflow (CWE-121 -
CVE-2026-68960
SKYSEA Client View/IT Manager堆栈缓冲区溢出漏洞
V. Comments for CVE-2025-6072
No comments yet