# ABB LVS MConfig Stores Passwords in Memory, Risking Global Infrastructure Compromise


## The Threat


ABB LVS MConfig, the parameterizing software used to configure low-voltage switchgear components across critical infrastructure worldwide, contains a cleartext memory storage vulnerability that allows attackers with local network access to extract sensitive credentials including passwords. The vulnerability, tracked as CVE-2025-9970, stems from a code defect that fails to encrypt or securely handle user credentials during runtime.


MConfig is deployed globally across critical sectors including energy generation and distribution, water treatment facilities, chemical manufacturing, food and agriculture processing, and transportation systems. The software manages configuration of ABB motor controllers, feeder controllers, operation panels, temperature monitoring solutions, and protocol converters—equipment that in many cases directly controls essential services affecting public safety and economic continuity.


The attack vector, while requiring local network access and specific user interaction, is particularly dangerous in industrial environments where network segmentation is often incomplete and legitimate technicians regularly connect to operational technology (OT) networks. An attacker who gains access to a network segment where MConfig is running can export the application's memory dump—capturing all active memory contents including plaintext passwords—and extract credentials without triggering traditional detection mechanisms.


## Severity and Impact


| Field | Value |

|-------|-------|

| CVE Identifier | CVE-2025-9970 |

| CVSS v3.1 Base Score | 7.4 (HIGH) |

| CVSS Vector | AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H |

| Attack Vector | Local Network (AV:L) |

| Attack Complexity | High (AC:H) |

| Privileges Required | Low (PR:L) |

| User Interaction | Required (UI:R) |

| CWE Classification | CWE-316: Cleartext Storage of Sensitive Information in Memory |

| Exploitation Status | Proof-of-Concept (E:P) |

| Remediation Level | Official Fix Available (RL:O) |


The high CVSS score reflects the potential impact to system integrity and confidentiality. While the attack requires local network presence and user interaction, the fact that it affects global critical infrastructure deployed in chemical plants, power grids, water systems, and transportation networks elevates the risk profile significantly.


## Affected Products


ABB LVS MConfig

  • Versions 1.4.9.21 and earlier
  • Status: Vulnerable
  • Fixed in: Version 1.4.9.22 and later

    • Affected Components Managed by MConfig

  • LV Motor Controllers
  • Feeder Controllers
  • Operation Panels
  • Temperature Monitoring Solutions
  • Protocol Converters

    • All installations of MConfig versions 1.4.9.21 or earlier used to configure ABB low-voltage switchgear components are potentially affected.


    ## Mitigations


    ### Immediate Actions


    Priority 1: Update to Patched Version

    ABB has released MConfig version 1.4.9.22 which resolves the vulnerability. Organizations should immediately schedule testing and deployment of this patched version across all affected installations. The update process should follow ABB's documented procedures and include backup/rollback plans appropriate to critical infrastructure environments.


    Priority 2: Access Control and Network Segmentation

    Implement strict access controls limiting who can connect to networks where MConfig is deployed. MConfig parameters should only be modified by authorized technicians through authenticated, auditable connections. Where possible, isolate the network segments containing MConfig instances from general corporate networks.


    Priority 3: Memory Dump Prevention

    Configure operating systems running MConfig to prevent unauthorized memory dump operations. On Windows systems, restrict debugging privileges and disable crash dump file generation in non-test environments. Monitor for and alert on any attempts to export process memory.


    Priority 4: Credential Rotation

    Following patch deployment, rotate all credentials that may have been exposed, particularly those stored in MConfig configuration or used to access network devices managed through MConfig. This includes any service accounts used by MConfig itself.


    ### Ongoing Defenses


  • Monitoring: Implement logging of MConfig access, configuration changes, and any memory-related operations
  • Network Monitoring: Monitor for suspicious memory dump tools or processes attempting to access MConfig memory space
  • Access Auditing: Maintain detailed audit logs of who accesses MConfig and when, particularly focusing on non-standard access patterns
  • Incident Response: Develop incident response procedures specific to potential MConfig credential compromise, including procedures for revoking and rotating credentials system-wide

    • ABB recommends referring to the MConfig product instruction manual for additional security configuration guidance and implementation of defensive measures appropriate to specific deployment environments.


    ## References


  • [CISA Vulnerability Summary: CVE-2025-9970 (ABB LVS MConfig)](https://cisa.gov)
  • [ABB LVS MConfig Official Advisory](https://abb.com/security)
  • [NVD CVE-2025-9970 Entry](https://nvd.nist.gov)
  • [CWE-316: Cleartext Storage of Sensitive Information in Memory](https://cwe.mitre.org/data/definitions/316.html)

    • ---


    ## HackWire Analysis


    This vulnerability exposes a pattern that persists stubbornly in industrial control software: fundamental security hygiene violations that would be unacceptable in consumer software yet remain endemic in OT environments. Storing passwords in plaintext in application memory in 2026 represents a failure at the architectural level—one that suggests MConfig's development priorities prioritized ease-of-implementation over security-by-design.


    What makes CVE-2025-9970 particularly dangerous is the sector-wide exposure. ABB is a dominant player in low-voltage switchgear globally, meaning this vulnerability affects a non-trivial portion of industrial infrastructure across multiple critical sectors simultaneously. A coordinated campaign targeting MConfig installations could provide attackers with footholds across energy, water, chemical, and transportation networks in different countries and jurisdictions.


    The "local network access required" framing can be misleading. In many industrial facilities, the OT network is physically accessible through switch rooms, equipment closets, and maintenance areas. Technicians move between networks regularly. Visitors, contractors, and supply chain partners access these facilities. The barrier to local network presence, while real, is lower than narrative framing often suggests—particularly when supply chain compromise or insider threats enter the equation.


    The proof-of-concept status and "official fix available" combination means this vulnerability will be exploited before all instances are patched. Memory dump attacks are increasing in sophistication and frequency as defensive tools mature; attackers actively seek environments where memory protections are weak. OT environments, designed for uptime and operational simplicity rather than contemporary security posture, are attractive targets.


    Organizations should treat this as a priority patch cycle. Any delay creates a window where attackers can map MConfig deployments, identify those still running vulnerable versions, and extract credentials that may provide lateral movement across critical infrastructure. — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)