ABB Zenon bundles vulnerable MongoDB across nine critical infrastructure sectors
The advisory doesn't say whether ABB has shipped a patched version or expects operators to manually replace a database engine in production ICS environments.
TL;DR
CISA issued ICS Advisory ICSA-26-218-01 for CVE-2025-14847, a CVSS 7.8 heap-memory-read vulnerability in ABB Ability Zenon's bundled MongoDB 4.2. The flaw affects all Zenon versions worldwide, deployed across chemical, energy, water, healthcare, communications, dams, critical manufacturing, IT, and wastewater sectors. ABB's mitigation: manually replace the bundled MongoDB with a patched version or uninstall IIoT services entirely. No mention of an ABB-supplied patch that fixes the dependency itself.
The vulnerability is in MongoDB's Zlib compressed protocol handling, not in ABB's code. A mismatched length field lets an unauthenticated remote attacker read uninitialized heap memory. CVSS 4.0 puts it at 8.7, network-accessible, no authentication, no user interaction. For an ICS platform managing physical infrastructure, that's the kind of vector that should get patched before the weekend.
ABB's advisory says to either replace the bundled MongoDB 4.2 with a supported version or remove IIoT services through the Control Panel uninstaller. That's it. No firmware update. No hotfix. No ABB-supplied installer that swaps the database engine. The guidance points operators to a Zenon online help section that explains how to install and configure their own MongoDB instance manually.
The advisory also bundles three additional MongoDB CVEs (CVE-2020-7928, CVE-2020-7921, and CVE-2020-7931) all from 2020, all in MongoDB 4.2, all now surfaced in Zenon because the dependency sat unaddressed for years.
The OT patching gap isn't the operator's fault this time
ICS patching is famously slow. Operators test updates for months, schedule downtime around production windows, and often can't apply fixes without vendor certification. That's a known constraint. But when the vendor itself ships a database version that went end-of-life for security support years ago, and then responds to the resulting CISA advisory with "replace it yourself," the bottleneck isn't the operator's change-control process. It's the supply chain.
Zenon is deployed in water treatment plants, energy grid control rooms, and chemical processing facilities. The nine critical infrastructure sectors listed in the advisory aren't boilerplate, they reflect where the platform is actually running. An attacker who can read heap memory on a system controlling physical processes isn't just stealing data; they're potentially mapping memory layouts for follow-on exploitation.
No patch means assessors should ask different questions
For C3PAOs and internal assessors evaluating Zenon deployments, the standard question ("have you applied the vendor's patch?") doesn't have an answer here. The right question is whether the IIoT services component is installed at all, and if so, which MongoDB version sits behind it. ABB's own mitigation says to uninstall IIoT services where they aren't needed. That's a configuration audit, not a patch-verification exercise.
The advisory references ABB PSIRT document 9AKK108472A9037 and a CSAF JSON file at psirt.abb.com. Operators who can't wait for ABB to bundle a supported MongoDB should start with the manual replacement path. Everyone else should verify IIoT services aren't running in environments where they don't need to be.
Published ·Deep Fathom