# ABB CoreSense Path Traversal Flaw Exposes Critical Infrastructure Systems to Unauthorized Access


## The Threat


ABB has disclosed a critical path traversal vulnerability affecting its CoreSense HM and CoreSense M10 monitoring platforms—industrial control systems deployed across global critical infrastructure. The flaw, tracked as CVE-2025-3465, allows unauthenticated attackers with local access to bypass directory restrictions and access sensitive files, potentially leading to complete system compromise.


The vulnerability stems from improper input validation in the file parameter handling of both CoreSense products. Rather than sanitizing user-supplied file paths, the systems allow traversal sequences (such as ../ notation) to escape restricted directories and access arbitrary files on the host machine. This classic path traversal attack vector, while well-understood, remains dangerous when deployed in mission-critical environments where sensitive operational data, configuration files, and credentials may be accessible.


For organizations operating in food and agriculture, commercial facilities, and critical manufacturing—sectors where CoreSense systems are actively deployed—this vulnerability represents a significant insider threat. An attacker with local system access, whether a disgruntled employee, contractor, or compromised workstation, can exfiltrate restricted directories without authentication. The exposed data could include system configurations, historical operational logs, and potentially authentication tokens or API credentials used to manage interconnected infrastructure.


## Severity and Impact


| Metric | Value |

|---|---|

| CVE Identifier | CVE-2025-3465 |

| CVSS v3.1 Score | 7.1 (HIGH) |

| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |

| Attack Vector | Local (AV:L) |

| Attack Complexity | Low (AC:L) |

| Privileges Required | None (PR:N) |

| User Interaction | Not required (UI:N) |

| Scope | Changed (S:C) |

| Confidentiality Impact | High (C:H) |

| Integrity Impact | None (I:N) |

| Availability Impact | None (A:N) |

| CWE Classification | CWE-22: Improper Limitation of a Pathname to a Restricted Directory |


## Affected Products


ABB CoreSense HM

  • Versions 2.3.1 and earlier
  • Version 2.3.4

    • ABB CoreSense M10

  • Versions 1.4.1.12 and earlier
  • Version 1.4.1.31

    • The affected versions span multiple release branches, suggesting the vulnerability exists in a shared code component used across both product lines.


    ## Mitigations


    Immediate Actions:

  • Apply vendor updates: ABB recommends deploying CoreSense HM v2.3.4 and CoreSense M10 v1.4.1.31 at the earliest opportunity. These patched versions implement strict input validation and path sanitization to prevent traversal sequences.
  • Access controls: Restrict local access to CoreSense systems to authorized personnel only. Implement operating system-level access controls to prevent untrusted users from directly interacting with the application on the host system.
  • Network segmentation: Isolate CoreSense monitoring systems on restricted network segments. Limit direct connections to authenticated administrative workstations and management networks only.

    • Detection and Response:

  • Audit file access logs for unusual traversal patterns or requests to system directories outside the intended application scope.
  • Monitor for exfiltration of sensitive files from CoreSense systems, particularly configuration files or logs containing operational data.
  • Review user access logs to identify which accounts have accessed the vulnerable systems and when.

    • Long-Term Hardening:

  • Implement principle of least privilege for CoreSense system accounts.
  • Enable logging and monitoring for all file access attempts on CoreSense hosts.
  • Conduct a security audit of CoreSense configurations to ensure sensitive files are properly restricted.

    • ## References


  • ABB Security Advisory: [ABB CoreSense HM and M10 Vulnerability Notice](https://www.abb.com/en) (via CISA coordination)
  • CVE-2025-3465 Details: National Vulnerability Database entry for comprehensive technical specifications
  • General Security Recommendations: Refer to ABB's product security documentation for additional hardening guidance

    • ---


    ## HackWire Analysis


    While path traversal vulnerabilities are textbook attack vectors, the significance of CVE-2025-3465 lies not in its novelty but in its deployment context. CoreSense systems monitor and manage critical operations in food production plants, manufacturing facilities, and agricultural infrastructure—environments where a single security breach can disrupt supply chains, contaminate products, or halt production at scale.


    The vulnerability's requirement for local access might seem like a limiting factor, but this misunderstands the threat landscape in industrial environments. Unlike corporate IT networks where workstations are heavily locked down, manufacturing plants often run legacy Windows or Linux systems in operational technology (OT) networks where local access is far more accessible—especially to contractors, maintenance staff, or employees with physical access to facility networks. A single compromised workstation on the plant floor becomes a beachhead to exfiltrate operational logs, system configurations, and credentials.


    The CVSS score of 7.1 reflects high confidentiality impact but zero integrity or availability impact, which is accurate for a read-only path traversal. However, this scoring can be deceptive: stolen configuration files and operational logs can enable lateral movement attacks, supply chain reconnaissance, or social engineering. For critical infrastructure operators, losing visibility into your own systems' operational history is itself a serious compromise.


    The fact that both CoreSense HM and M10 share this vulnerability suggests a common architectural pattern across ABB's monitoring product line. Organizations running either product should assume other ABB systems may harbor similar issues. This is a good moment to conduct a broader security audit of deployed ABB systems and validate that local access controls are properly implemented across all instances.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)