ABB Ability Zenon: 13 CVEs, High 7.8
Summary
CISA reports 13 vulnerabilities in ABB Ability Zenon, IIoT services with MongoDB. Weakness types: Improper Handling of Length Parameter Inconsistency, Improper Neutralization of Null Byte or NUL Character, Collapse of Data into Unsafe Value (+9 more). ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. Highest CVSS v3 score: 7.8 (High), not remotely exploitable per its CVSS vector. At least one CVE is on CISA's Known Exploited Vulnerabilities list.
At a glance
- Vendor
- ABB
- Products
- Ability Zenon, IIoT services with MongoDB
- CVEs
- CVE-2025-14847, CVE-2020-7928, CVE-2020-7921, CVE-2020-7925, CVE-2020-7929, CVE-2020-7923, CVE-2021-20330, CVE-2021-32036, CVE-2021-32040, CVE-2021-20333, CVE-2020-7924, CVE-2021-20328, CVE-2021-20334
- Highest CVSS v3
- 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C
- Highest CVSS v4
- –
- Known exploited (KEV)
- Yes
- Sectors (per CISA)
- Chemical, Communications, Critical Manufacturing, Dams, Energy, Healthcare and Public Health, Information Technology, Water and Wastewater
- Deployed
- Worldwide
- Vendor HQ
- Switzerland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2025-14847 | Improper Handling of Length Parameter Inconsistency | 7.5 | – | Yes (added 2025-12-29) | CVE-2025-14847 |
| CVE-2020-7928 | Improper Neutralization of Null Byte or NUL Character | 6.5 | – | No | CVE-2020-7928 |
| CVE-2020-7921 | Collapse of Data into Unsafe Value | 5.3 | – | No | CVE-2020-7921 |
| CVE-2020-7925 | Undefined Behavior for Input to API | 7.5 | – | No | CVE-2020-7925 |
| CVE-2020-7929 | Incorrect Regular Expression | 6.5 | – | No | CVE-2020-7929 |
| CVE-2020-7923 | Uncaught Exception | 6.5 | – | No | CVE-2020-7923 |
| CVE-2021-20330 | Reachable Assertion | 6.5 | – | No | CVE-2021-20330 |
| CVE-2021-32036 | Allocation of Resources Without Limits or Throttling | 7.1 | – | No | CVE-2021-32036 |
| CVE-2021-32040 | Out-of-bounds Write | 7.5 | – | No | CVE-2021-32040 |
| CVE-2021-20333 | Improper Output Neutralization for Logs | 5.3 | – | No | CVE-2021-20333 |
| CVE-2020-7924 | Improper Certificate Validation | 6.5 | – | No | CVE-2020-7924 |
| CVE-2021-20328 | Improper Certificate Validation | 6.8 | – | No | CVE-2021-20328 |
| CVE-2021-20334 | Execution with Unnecessary Privileges | 7.8 | – | No | CVE-2021-20334 |
Affected products (2)
- ABB Ability Zenon /all
- IIoT services with MongoDB 4.2
Vendor fixes and mitigations (from advisory)
- Mitigation: ABB recommends the following mitigation measures: - Replace bundled MongoDB with a supported version if IIoT services are required: - Where IIoT functionality is required, the bundled MongoDB instance can be replaced with a supported and patched version through manual configuration. - The following zenon online help section explains the process of installing and using your own MongoDB database: zenHelpViewer - Uninstall IIoT Services wherever it’s not required: - If IIoT Services are not required, they can be removed using the Control panel uninstaller. This eliminates the dependency on
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-218-01
- Machine-readable CSAF record
- https://psirt.abb.com/csaf/2026/9akk108472a9037.json
- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108472A9037&LanguageCode=en&Do
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.