CVE-2025-7064: ABB Freelance Authentication Bypass (CVSS 6.6)

Technical summary

CVE-2025-7064 is an authentication bypass vulnerability rooted in CWE-305 (Use of Insufficiently Random Values). The flaw permits privilege escalation via local attack vector without requiring user interaction. The vulnerability exists across all tested Freelance versions from 2013 through 2024, including service packs and feature packs. With CVSS 3.1 score of 6.6 (MEDIUM severity), the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L indicates low attack complexity, local access requirement, and low privilege escalation needed to trigger integrity and limited confidentiality/availability impact.

Business impact

Organizations relying on Freelance for industrial automation and control systems face potential unauthorized access to system functions and data modification. The integrity impact could lead to tampering with automation logic or configuration, affecting operational continuity. While not currently listed on CISA's Known Exploited Vulnerabilities catalog, the broad version range affected increases organizational exposure if Freelance instances lack additional access controls or network segmentation.

Affected systems

ABB Freelance versions affected include: all releases through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1, 2019 SP1 FP1, and 2024. Organizations using any of these versions in production environments require immediate assessment and remediation planning.

Exploitability

Exploitation requires local system access and valid user credentials at the privilege level of the Freelance system. Attack complexity is low once local access is obtained, meaning an authenticated insider or an attacker who has already compromised user-level access can execute the bypass without sophisticated techniques. The vulnerability does not require user interaction, making it reliably exploitable under those conditions. Current evidence does not indicate active exploitation in the wild, though the broad affected version range warrants proactive patching.

Remediation

ABB will release security patches addressing this authentication weakness. Organizations should consult the official ABB security advisory for patch availability and version-specific guidance. Interim mitigations include restricting local system access through operating system-level controls, limiting Freelance user accounts to essential personnel, and implementing network segmentation to prevent unauthorized lateral movement to Freelance systems.

Patch guidance

Monitor ABB's official security bulletins and product update portals for patched versions of Freelance. When patches become available, validate compatibility with your deployment environment and test thoroughly in staging before production deployment. Given the version span, prioritize testing for systems running the oldest affected versions (2013, 2016) first, as support status may influence patching timelines. Verify patch applicability against your specific Freelance build and service pack level.

Detection guidance

Monitor system and application logs for failed authentication attempts followed by successful access with mismatched privilege levels. Review user account activity and privilege escalation events on systems running Freelance. Endpoint detection and response (EDR) solutions should flag unexpected privilege elevation or lateral movement originating from Freelance processes. Network intrusion detection may be limited due to the local attack vector, so focus on host-based detection and access control auditing.

Why prioritize this

Despite MEDIUM CVSS severity, this vulnerability merits priority attention because: (1) it affects a broad product timeline spanning 12 years and multiple major versions, indicating potentially high install base; (2) integrity impact could affect critical industrial control logic; (3) the local attack vector combined with low privilege requirements creates meaningful risk in shared hosting or multi-tenant environments; (4) absence from KEV status does not indicate low risk—it reflects current lack of observed exploitation, not absence of exploitability. Organizations should treat this as a moderate-priority patch candidate rather than deferred maintenance.

Risk score, explained

The CVSS 3.1 score of 6.6 reflects a balance of factors: local attack vector and low privilege requirement limit immediate exposure but do not eliminate it; low attack complexity means exploitation is straightforward once preconditions are met; integrity impact is high, indicating potential for meaningful system compromise; confidentiality and availability impacts are lower. For industrial environments or organizations where Freelance systems contain sensitive automation logic, the real-world risk may exceed the base CVSS due to business criticality and the span of affected versions.

Frequently asked questions