CVE-2025-14510CWE-303

ABB Ability OPTIMAX Authentication Bypass in Single-Sign On

Critical · published January 16, 2026

CVSS v4.0
9.2
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

🚨 An incorrect implementation of the authentication algorithm in ABB Ability OPTIMAX leaves doors wide open for mischief! 🔥 Think of it as a hotel where the front desk accidentally gives out keys to every single room without checking IDs. Anyone can waltz in and access sensitive areas without so much as a glance from the staff! This security blunder could allow an attacker to bypass authentication entirely, potentially leading to unauthorized access to critical system controls. The repercussions could be absolutely devastating, with the possibility of data breaches or disruptions in operations!

Put simply

Think of it as a hotel where the front desk accidentally gives out keys to every single room without checking IDs. Anyone can waltz in and access sensitive areas without so much as a glance from the staff! The vulnerability arises from a flaw in the authentication algorithm, affecting versions 6.1, 6.2, and all releases prior to 6.3.1-251120 and 6.4.1-251120. This means that an attacker could exploit this issue to gain access without proper credentials.

What to do

This security blunder could allow an attacker to bypass authentication entirely, potentially leading to unauthorized access to critical system controls. The repercussions could be absolutely devastating, with the possibility of data breaches or disruptions in operations! Immediate remediation is paramount! Update ABB Ability OPTIMAX to version 6.3.1-251120 or 6.4.1-251120 to patch this critical vulnerability. Ensure that all instances are reviewed for proper authentication measures post-update. 🛡️ You've got this! By following these steps, you'll strengthen your defenses and keep your systems secure! 🚀

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00433 · 36.5th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-01-16T13:02Z
EPSS history
Timeline
  • 16 JAN 13:02Z
    ABB Ability OPTIMAX Authentication Bypass in Single-Sign On
    cvelistv5