Cyber Resilience

CVE-2025-14510

Auth Bypass

Auth Bypass
Published
16 January 2026
Modified
15 April 2026
CVSS Score v4 9.2
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0040 34th percentile
Risk Priority 36 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-14510 is a critical-severity Incorrect Implementation of Authentication Algorithm (CWE-303) vulnerability in Abb (inferred from references). Its CVSS base score is 9.2 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-14510, published on 2026-01-16, is an Incorrect Implementation of Authentication Algorithm vulnerability (CWE-303) in ABB Ability OPTIMAX. The issue affects versions 6.1 and 6.2, as well as versions from 6.3.0 before 6.3.1-251120 and from 6.4.0 before 6.4.1-251120. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to substantial impacts on confidentiality, integrity, and availability.

Attackers with network access can exploit this vulnerability without authentication privileges or user interaction, though it requires high attack complexity. Successful exploitation enables high-impact disruption, including unauthorized access to sensitive data, modification of system integrity, and denial of service affecting availability, all within the unchanged scope of the affected component.

ABB provides further details and mitigation guidance in its security advisory at https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A1331&LanguageCode=en&DocumentPartId=&Action=Launch, which aligns with upgrading to patched releases such as 6.3.1-251120 and 6.4.1-251120.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability Data

Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 before 6.3.1-251120, from 6.4.0 before 6.4.1-251120.

CWE(s)
CWE-303

Related Threats

MITRE ATT&CK Enterprise Techniques

T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-33190Shared CWE-303
CVE-2026-32953Shared CWE-303
CVE-2023-32152Shared CWE-303
CVE-2026-43640Shared CWE-303
CVE-2023-39953Shared CWE-303
CVE-2025-44557Shared CWE-303
CVE-2026-57852Shared CWE-303
CVE-2023-4860Shared CWE-303
CVE-2024-10214Shared CWE-303
CVE-2024-9999Shared CWE-303

Affected Assets

Abb
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation at post-design stages directly uncovers incorrect implementations of required authentication algorithms.

SA-15 Development Process, Standards, and Tools partial match

Requiring documented development processes, standards, and tools reduces the chance that an established authentication algorithm is coded incorrectly.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require correct implementation of authentication algorithms.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.5 Secure authentication full match
degrades

Secure authentication control directly requires correct implementation of authentication algorithms.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect flawed authentication implementations but does not prevent them by itself.

A.8.24 Use of cryptography partial match
degrades

Cryptography control addresses proper use of authentication algorithms but is broader than authentication alone.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes verification steps that can catch incorrect authentication implementations.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify correct authentication algorithm use but do not guarantee correct implementation.

A.8.28 Secure coding partial match
prevents

Secure coding practices reduce the likelihood of incorrect authentication algorithm implementation.

References