CVE-2025-6074

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE.

When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data.

This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-321

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-607497.8DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe.CVE-2025-60755.5If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.CVE-2025-607517.5GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDecode.CVE-2025-607535.5An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted CVE-2025-60768.8Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an CVE-2025-60779.8Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the adm CVE-2025-607729.8Improper authentication in the web-based management interface of NETLINK HG322G V1.0.00-231017, allows a remote unauthenticated attacker to CVE-2025-60785.4Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page wh CVE-2025-607816.1PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) in the worksheet.php file via the participant_name parameter.CVE-2025-607825.4PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics managem CVE-2025-607836.5There is a SQL injection vulnerability in Restaurant Management System DBMS Project v1.0 via login.php. The vulnerability allows attackers t CVE-2025-607846.5A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.