Is CVE-2025-14847 known to be exploited?

It is not marked known-exploited in this record.

CVE-2025-14847

ABB recommends replacing the bundled MongoDB instance with a supported and patched version, or uninstalling IIoT Services where not required. Users should update MongoDB to versions at or above the patch thresholds (e.g., MongoDB Server v7.0.28+, v8.0.17+, v8.2.3+, v6.0.27+, v5.0.32+, v4.4.30+, v4.2.9+, v4.0.20+, v3.6.20+). Refer to ABB PSIRT advisory 9AKK108472A9037 and zenon online help for configuration guidance.

Quick answers

What is CVE-2025-14847?: ABB recommends replacing the bundled MongoDB instance with a supported and patched version, or uninstalling IIoT Services where not required. Users should update MongoDB to versions at or above the patch thresholds (e.g., MongoDB Server v7.0.28+, v8.0.17+, v8.2.3+, v6.0.27+, v5.0.32+, v4.4.30+, v4.2.9+, v4.0.20+, v3.6.20+). Refer to ABB PSIRT advisory 9AKK108472A9037 and zenon online help for configuration guidance.
How severe is CVE-2025-14847?: high, CVSS 8.7
Is CVE-2025-14847 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2025-14847 be mitigated?: ABB recommends replacing the bundled MongoDB instance with a supported and patched version, or uninstalling IIoT Services where not required. Users should update MongoDB to versions at or above the patch thresholds (e.g., MongoDB Server v7.0.28+, v8.0.17+, v8.2.3+, v6.0.27+, v5.0.32+, v4.4.30+, v4.2.9+, v4.0.20+, v3.6.20+). Refer to ABB PSIRT advisory 9AKK108472A9037 and zenon online help for configuration guidance.

CVSS

8.7

Vendor

ABB

Published

Sep 30, 2026 · 08:05

Patch

Unknown / not confirmed

Affected products

ABB Ability Zenon

Mitigation

Multiple Vulnerabilities Discovered in ABB Ability Zenon IIoT Services with Bundled MongoDB

An advisory published by CISA and ABB PSIRT discloses multiple vulnerabilities in ABB Ability Zenon Industrial IoT services. The flaws involve CVE-2025-14847, a heap memory read issue in Zlib compressed protocol headers affecting all MongoDB versions prior to specified patch levels, and CVE-2020-7928, a memory read overrun affecting older MongoDB versions. Both vulnerabilities affect ABB Ability Zenon versions with MongoDB 4.2 installed and have been assigned CVSS scores up to 8.7. ABB recommends replacing the bundled MongoDB with a supported patched version or uninstalling IIoT services where not required.

—2m

CVE-2025-14847

Quick answers

Related News

Multiple Vulnerabilities Discovered in ABB Ability Zenon IIoT Services with Bundled MongoDB