Improper neutralization of input during web page generation

CVE-2025-14773 is a cross-site scripting flaw in the ABB T-MAC Plus web interface. Based on the supplied CVSS (AV:N/AC:L/PR:L/UI:R) and the product’s role as a terminal-management web application, the most plausible path is *authenticated script injection that executes when another logged-in user views affected content*; that stored-XSS assumption is an inference from the vector because I could not verify a public ABB advisory with exact technical details or affected version ranges. Publicly verifiable fixed-version data was also not available from the sources I could reach.

ABB’s HIGH 8.0 rating overshoots the real operational risk for most enterprises. The decisive friction is the chain: an attacker must reach the T-MAC Plus UI, hold at least low-privileged credentials, plant payload-bearing input, and then wait for another user to render it; in real OT deployments that usually means *post-initial-access on an internal operations network*, not an internet-scale pre-auth compromise.

Why this verdict

• Requires authenticated access: PR:L means the attacker already has credentials, which usually implies prior compromise, insider misuse, or third-party account abuse.
• Requires user interaction: UI:R means no page view, no exploit. That sharply limits reliability versus wormable or one-shot server-side flaws.
• Exposure population is narrow: T-MAC Plus is an OT terminal-management platform, so most real deployments live behind segmentation, VPN, jump hosts, or vendor remote-access controls rather than open internet.
• No field evidence of weaponization: no KEV listing, no public PoC found, and the supplied EPSS is extremely low.
• Vendor impact looks worst-case: scoring C:H/I:H/A:H assumes the victim session can be abused into meaningful operational actions, but that depends on role permissions and workflow design, not on the XSS alone.

Why not higher?

This is not pre-auth remote code execution, not a server-side auth bypass, and not a perimeter edge bug with known broad exposure. Every prerequisite in the chain compounds downward pressure: reachable UI, valid account, injectable field, and a second user viewing the content. Without those, the bug is inert.

Why not lower?

It is still an OT web application tied to terminal operations, so browser-session abuse against an operator or admin may have outsized business consequences inside the site. Also, authenticated XSS in industrial management software is more serious than the same bug in a low-value brochure app because operator sessions can trigger real workflows.

1. Restrict UI reachability — Put the T-MAC Plus web UI behind OT firewalls, jump hosts, or VPN-only access so an attacker needs an additional foothold before they can even touch the vulnerable page. For a MEDIUM verdict there is no mitigation SLA, but this is the first control to apply whenever exposure is broader than intended.
2. Separate low-privilege and admin use — Keep engineering/admin accounts off day-to-day operator browsing and use separate browser profiles or dedicated admin workstations. That reduces the payoff if a low-privileged user can plant script for a higher-privileged victim.
3. Harden the browser side — Where product support allows it, enforce CSP, HttpOnly, SameSite, short session lifetimes, and re-authentication for sensitive actions through the front-end or reverse proxy layer. This cuts session theft value and forces additional hurdles after payload execution.
4. Review editable fields and workflows — Identify screens where operators, contractors, or integrators can submit free-form text later rendered to others, then reduce who can edit them. With no mitigation SLA for MEDIUM, do this during normal remediation planning rather than emergency change windows.
5. Turn on application audit review — Monitor for unusual create/edit actions in forms, comments, labels, or notes followed by high-privilege actions from another user session. This is one of the few practical ways to spot stored-XSS abuse in OT web software.

Run this on the T-MAC Plus application server or gold image, not from an auditor laptop. Invoke it from an elevated PowerShell prompt like powershell -ExecutionPolicy Bypass -File .\check-tmacplus-cve-2025-14773.ps1 -FixedVersion 0.0.0 after you obtain ABB's actual fixed version from support; local admin helps for full registry and service inspection, but read-only execution usually works.

# check-tmacplus-cve-2025-14773.ps1

# Purpose: Locate ABB T-MAC Plus components and compare discovered version to a known fixed version.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


param(
    [string]$FixedVersion = "",
    [switch]$VerboseMode
)

function Write-Info($msg) {
    if ($VerboseMode) { Write-Host "[INFO] $msg" }
}

function Normalize-Version([string]$v) {
    if ([string]::IsNullOrWhiteSpace($v)) { return $null }
    $clean = ($v -replace '[^0-9\.]', '')
    if ([string]::IsNullOrWhiteSpace($clean)) { return $null }
    try { return [version]$clean } catch { return $null }
}

function Get-UninstallEntries {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )
    $items = @()
    foreach ($p in $paths) {
        try {
            $items += Get-ItemProperty $p -ErrorAction SilentlyContinue |
                Where-Object { $_.DisplayName -match 'ABB|T-MAC|TMAC|Terminal Management' }
        } catch {}
    }
    return $items
}

function Get-CandidateFiles {
    $roots = @(
        $env:ProgramFiles,
        ${env:ProgramFiles(x86)},
        'C:\ABB',
        'C:\inetpub',
        'C:\ProgramData'
    ) | Where-Object { $_ -and (Test-Path $_) }

    $patterns = @('*.exe','*.dll','web.config')
    $hits = @()
    foreach ($root in $roots) {
        try {
            $hits += Get-ChildItem -Path $root -Recurse -File -ErrorAction SilentlyContinue |
                Where-Object {
                    $_.FullName -match 'T-MAC|TMAC|Terminal' -or $_.VersionInfo.ProductName -match 'ABB|T-MAC|Terminal'
                }
        } catch {}
    }
    return $hits | Select-Object -First 50
}

function Get-BestVersion($entries, $files) {
    $versions = New-Object System.Collections.Generic.List[object]

    foreach ($e in $entries) {
        $nv = Normalize-Version $e.DisplayVersion
        if ($nv) {
            $versions.Add([pscustomobject]@{ Source='Registry'; Name=$e.DisplayName; Version=$nv.ToString() })
        }
    }

    foreach ($f in $files) {
        try {
            $fv = $f.VersionInfo.FileVersion
            $nv = Normalize-Version $fv
            if ($nv) {
                $versions.Add([pscustomobject]@{ Source='File'; Name=$f.FullName; Version=$nv.ToString() })
            }
        } catch {}
    }

    if ($versions.Count -eq 0) { return $null }

    $sorted = $versions | Sort-Object { Normalize-Version $_.Version } -Descending
    return $sorted[0]
}

Write-Info 'Searching uninstall registry...'
$entries = Get-UninstallEntries
Write-Info ('Registry hits: ' + (($entries | Measure-Object).Count))

Write-Info 'Searching candidate files...'
$files = Get-CandidateFiles
Write-Info ('File hits: ' + (($files | Measure-Object).Count))

$best = Get-BestVersion -entries $entries -files $files

if (-not $best) {
    Write-Host 'UNKNOWN - No ABB T-MAC Plus installation evidence or parsable version found.'
    exit 2
}

Write-Info ("Best candidate: $($best.Name) [$($best.Source)] version $($best.Version)")
$installed = Normalize-Version $best.Version
$fixed = Normalize-Version $FixedVersion

if (-not $fixed) {
    Write-Host ("UNKNOWN - Detected ABB/T-MAC component version " + $installed + ". No verified fixed version supplied; obtain ABB advisory/support guidance and rerun with -FixedVersion.")
    exit 2
}

if ($installed -lt $fixed) {
    Write-Host ("VULNERABLE - Detected version " + $installed + " is older than fixed version " + $fixed)
    exit 1
} else {
    Write-Host ("PATCHED - Detected version " + $installed + " is at or above fixed version " + $fixed)
    exit 0
}

Sources

1. ABB Ability Terminal Management product description
2. ABB T-MAC Plus sales guide
3. ABB T-MAC Plus product overview event page
4. ABB T-MAC Plus deployment case study
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API
7. FIRST EPSS FAQ
8. CVE Program cvelistV5 repository