CVE-2025-4676CWE-303

CVE-2025-4676

High · published January 7, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

⚡ An incorrect implementation of the authentication algorithm in ABB WebPro SNMP Card PowerValue could let attackers waltz right past security checks! 🔥 This is like having a restaurant where the host just trusts anyone who says they made a reservation, completely skipping the ID check at the door. So, a crafty guest could just walk in and seat themselves without ever being verified! If exploited, this vulnerability could allow unauthorized users to access sensitive functions and data within the ABB WebPro SNMP Card PowerValue. Since the authentication isn't being properly enforced, attackers could potentially manipulate device settings or intercept sensitive information, leading to significant operational disruptions and security risks.

Put simply

This is like having a restaurant where the host just trusts anyone who says they made a reservation, completely skipping the ID check at the door. So, a crafty guest could just walk in and seat themselves without ever being verified! The vulnerability stems from an incorrect implementation of the authentication algorithm in the affected versions of ABB WebPro SNMP Card PowerValue and PowerValue UL, allowing attackers to bypass authentication mechanisms entirely.

What to do

If exploited, this vulnerability could allow unauthorized users to access sensitive functions and data within the ABB WebPro SNMP Card PowerValue. Since the authentication isn't being properly enforced, attackers could potentially manipulate device settings or intercept sensitive information, leading to significant operational disruptions and security risks. To mitigate this risk, update the ABB WebPro SNMP Card PowerValue and PowerValue UL to version 1.1.8.L or above. Regularly review and strengthen authentication mechanisms as part of your security protocols. Additionally, consider implementing logging to detect unauthorized access attempts. You've got this! With these steps, you can shore up your defenses and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-01-07T22:16Z
References (1)
EPSS history
Timeline
  • 07 JAN 17:02Z
    Authentication bypass by brute forcing Authentication Headers
    cvelistv5