OTPulse

​​PVI​ ​​Insertion of Sensitive Information into Logfile

MonitorCVSS 5sa26p001Jan 29, 2026
ABB
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionRequired
Summary

ABB PVI client versions before 6.5.0 contain a vulnerability where sensitive information can be written to log files. An attacker with local file system access could read these logs and extract credentials, configuration details, or other sensitive data. Logging is disabled by default in all PVI versions, so the risk only exists if an administrator has explicitly enabled logging for troubleshooting or diagnostic purposes.

What this means
What could happen
An attacker with local access to a machine running PVI could read sensitive information (such as credentials or configuration details) from log files if logging has been enabled. Since logging is disabled by default, this only poses a risk if an administrator has explicitly turned on logging.
Who's at risk
Organizations using ABB PVI (Process Visualization Interface) client versions before 6.5.0 are affected. This impacts engineering teams and automation engineers who use PVI for process visualization and configuration of ABB automation systems. Risk is elevated in environments where logging has been intentionally enabled for diagnostics.
How it could be exploited
An attacker with local access to the PVI client machine could examine log files if logging is enabled, extracting sensitive information such as credentials, process parameters, or authentication tokens that may be written to the logs.
Prerequisites
  • Local access to the machine running PVI
  • Logging must be explicitly enabled (disabled by default)
  • File system permissions to read log files
Requires local accessRequires user action (logging must be explicitly enabled)Low EPSS score (0.0%)
Exploitability
Unlikely to be exploited — EPSS score 0.0%
Affected products (1)
ProductAffected VersionsFix Status
​​PVI​ <6.5.0<6.5.06.5.0
Remediation & Mitigation
0/2
Do now
0/1
WORKAROUNDIf upgrading cannot be done immediately, disable logging in PVI unless it is required for troubleshooting
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate PVI to version 6.5.0 or later
View full ABB PSIRT advisory
API: /api/v1/advisories/d39993ff-324f-4655-a8cb-7b0238369376

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.