AC500 V3 Stack buffer overflow in Cryptographic Message Syntax

An attacker could exploit a stack buffer overflow in AC500 V3 firmware to crash the programmable logic controller, causing a denial-of-service condition that interrupts process control and automation. In the worst case, the attacker could achieve remote code execution and directly manipulate industrial processes.

AC500 V3 programmable logic controllers (PLCs) used in municipal and industrial automation systems for process control. This affects water treatment plants, power distribution automation, and any facility using ABB AC500 V3 controllers for critical process control or safety functions.

An attacker with network access to the AC500 V3 controller can send a specially crafted message containing a stack buffer overflow in the Cryptographic Message Syntax (CMS) processing code. No authentication is required. If successful, the overflow allows the attacker to overwrite the stack and execute arbitrary code on the PLC, potentially altering process setpoints, disabling safety interlocks, or halting operations entirely.