External risk intelligence

ABB ALS-mini IP Missing Authentication for Critical Function Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-9574

The affected products are ABB ALS-mini IP-based access control systems. These devices are designed to function as network-connected security appliances, often deployed as edge-facing components to manage physical access points. Given their role as connected building management and security gateways, they are frequently reachable via network environments and commonly possess interfaces accessible for management or operational tasks.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts ABB ALS-mini IP-based access control systems, potentially allowing unauthorized access to critical functions. The primary concern is to confirm if these systems are in use and whether they are exposed to potential network-based threats.

Unauthenticated access to critical functions.
Confirm relevance and exposure of this issue.
Verify if these systems are in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable ABB ALS-mini IP devices over the network without needing any credentials or prior access. Once connected, they can leverage the missing authentication to trigger a critical function, potentially leading to a complete system compromise.

Entry condition: Network accessibility, no authentication required.
Trigger point: Missing authentication for critical function.
Resulting risk: Complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact ABB ALS-mini IP devices, potentially affecting their critical functions when accessed. No specific data types or PII are indicated as at risk based on the provided context.

Critical functions of the device.
Unauthorized access over a network.
Compromised system availability or control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects ABB ALS-mini IP-based access control systems with serial numbers from 2000 to 5166. Determining ownership and initial exposure is critical. Application owners or system administrators are likely responsible for managing these devices. The first practical step involves identifying all instances of the affected technology, confirming their network reachability and business criticality, and then engaging the accountable owner to plan remediation based on risk.

Own the issue: Application owners/System administrators.
Verify first: Device network reachability and criticality.
Action: Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ABB ALS-mini IP?

These are network-connected security appliances used for access control. They function as gateways in building management systems to manage physical access points like doors or gates, typically residing at the edge of a network to bridge physical security with digital management.

How does CVE-2025-9574 work?

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306). It means the device fails to verify the identity of a user before performing sensitive tasks. An unauthorized party can interact with administrative or control features that are intended to be restricted.

Do I need special access to trigger CVE-2025-9574?

No. The vulnerability does not require prior credentials or privileged access. It is triggered by simply connecting to the device over the network. It is not triggered by physical interaction alone, but by reaching the system's network-accessible management or operational interfaces.

Is my organization at risk from this vulnerability?

You should investigate if you use ABB ALS-mini-s4 IP or s8 IP units with serial numbers between 2000 and 5166. Halo Surface Signal notes these devices are often deployed as edge-facing components, meaning they are frequently reachable via the network, which increases the likelihood of unauthorized access attempts.

When should I take action on this CVE?

Prioritize identifying all affected hardware in your environment immediately. Since the system allows unauthenticated control, verify if these units are reachable from untrusted networks. Once identified, work with the device owners to assess the business impact and determine the necessary steps to secure or restrict access.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.