ABB T‑MAC Plus exposes an incorrect authorization flaw that allows an attacker to bypass normal access controls when communicating with the TP2CardReaderService daemon. The vulnerability, classified as CWE‑863, could enable the attacker to retrieve or modify card reader data, issue control commands, or otherwise manipulate the device operation without proper privilege. This undermines confidentiality, integrity, and potentially availability of the device's functions.

The flaw affects ABB T‑MAC Plus software versions 4.0 through 24. The affected system is the vendor’s programmable logic controller with integrated card reader functionality.

The CVSS score of 7.2 indicates a high‑severity condition with moderate exploitation complexity. No EPSS data is available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The attack likely requires access to the local or network interface used by the TP2CardReaderService daemon; if the service is exposed externally, remote exploitation could be feasible, whereas internal or offline access would be needed otherwise.