CVE-2025-14773
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
ABB T-MAC Plus version 4.0-24 is vulnerable to cross-site scripting (XSS) due to improper neutralization of input during web page generation. An attacker can inject malicious scripts that execute in the victim's browser.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in the context of their session, compromising data confidentiality and integrity.
Recommendation
Update ABB T-MAC Plus to a version that includes an XSS fix. Implement input validation and sanitization mechanisms and apply Content-Security-Policy headers.
Other vulnerabilities in ABB T-MAC Plus
See all- CVE-2025-14771Critical
ABB T-MAC Plus version 4.0-24 contains a vulnerability allowing external parties to access files or directories.
- CVE-2025-14774High
ABB T-MAC Plus version 4.0-24 suffers from an incorrect authorization vulnerability, allowing a user to access functions or data they should not be permitted to.
- CVE-2025-14772High
Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus version 4.0-24.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.