Exploitation ongoing with high activity in latest observed window (3 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Missing Authentication for Critical Function vulnerability in ABB ABB AbilityTM zenon.This issue affects ABB AbilityTM zenon: from 7.50 through 14.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
NEW THREAT INTEL: ABB zenon RTS unauth remote-reboot (CVE-2025-8754) hits HMI/SCADA across 8 critical sectors. https://intel.threadlinqs.com/threat/TL-2026-0594 #ThreatIntel #ICS #OTSecurity https://t.co/tpyxKgA6CY
Post summary
The alert indicates that CVE-2025-8754 is actively exploited to perform unauthenticated remote reboots on HMI/SCADA systems in eight critical sectors.
🚨 Unauthenticated remote reboot in ABB zenon (CVE-2025-8754) = “nothing burger” until your plant goes dark. Code execution isn’t needed for downtime to become a business incident. #Windows #Security #OT #CVE https://windowsforum.com/threads/cve-2025-8754-abb-zenon-remote-transport-lets-attackers-reboot-targets.419713/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #IndustrialCybersecurity #AbbZenonSecurity https://t.co/0BvxSWQ4cG
Post summary
The tweet highlights the ABB zenon remote reboot issue (CVE‑2025‑8754) as a potential cause of business downtime, but provides no PoC, exploit, patch, or verification of active exploitation.
Attackers exploiting CVE-2025-8754 in ABB Ability™ zenon can remotely reboot industrial control systems without authentication. This missing auth flaw enables lateral movement across OT networks, triggering denial of service conditions. Runtime segmentation helps contain such post-compromise activity. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/icsa-26-146-03-cve-2025-8754
Post summary
Attackers are actively exploiting CVE-2025-8754 to remotely reboot ABB Ability™ zenon systems without authentication, enabling lateral movement and denial-of-service across OT networks.