Technical impact
The vulnerability is a broken access control flaw where a user‑controlled key allows an attacker to bypass authorization checks within the ABB T‑MAC Plus web interface. This permits unauthorized users to gain privileges they should not have. While the description does not explicitly state the scope of data exposed, it is inferred that sensitive configuration data, control commands, or other privileged functions could be accessed. The weakness is classified as CWE‑639: Permission or Access Control Holds Wrong Value.
Affected Systems
The flaw affects the ABB T‑MAC Plus web application in versions ranging from 4.0 through 24.0. Devices running any of these releases are susceptible unless a subsequent patch or firmware update has removed the user‑controlled key mechanism.
Risk and Exploitability
The CVSS base score of 7.3 marks this issue as High, indicating a significant potential impact. The EPSS score is currently unavailable, and the lack of a KEV listing suggests that no mass exploitation is reported yet. Attackers can exploit the flaw remotely by sending crafted requests to the web interface, assuming network access to the device. While the description does not state the exact prerequisites for exploitation, it is inferred that elevation of privilege can be achieved without authentication. Consequently, organizations should treat this as a high‑risk finding pending patch deployment.
