ABB System 800xA and Symphony Plus IEC 61850 Denial-of-Service Vulnerability

ABB System 800xA and Symphony Plus IEC 61850 products are vulnerable to a denial-of-service attack due to improper validation of input within the IEC 61850 communication stack. This affects specific modules within the AC800M, Symphony Plus SD Series, Symphony Plus MR, and S+ Operations product lines. An attacker with network access to the IEC 61850 network can exploit this vulnerability by sending a specially crafted 61850 packet. The exploitation leads to device faults in PM 877, CI850, and CI868 modules, requiring manual restarts, or causes unavailability of the S+ Operations 61850 connectivity due to communication driver crashes. The System 800xA IEC61850 Connect is not affected by this vulnerability. This issue was reported to ABB by Hitachi Energy and affects firmware versions prior to the patched releases detailed in ABB’s advisory.

Attack Chain

1. Attacker gains network access to the targeted IEC 61850 network.
2. Attacker identifies a vulnerable ABB device (PM 877, CI850, CI868 modules, or S+ Operations node).
3. Attacker crafts a malicious IEC 61850 packet specifically designed to exploit the input validation vulnerability (CVE-2025-3756).
4. Attacker sends the crafted packet to the targeted vulnerable ABB device via the IEC 61850 network.
5. The vulnerable device processes the malicious packet.
6. Due to the input validation flaw, the processing of the crafted packet triggers a fault condition in PM 877, CI850, or CI868 modules, or a crash in the S+ Operations IEC 61850 communication driver.
7. The affected module or node becomes unavailable, resulting in a denial-of-service.
8. For PM 877, CI850, and CI868 modules, manual restart of the device is required to restore functionality. S+ Operations requires restarting the IEC 61850 communication driver.

Impact

Successful exploitation of this vulnerability can disrupt critical industrial control processes. Affected sectors include Chemical, Critical Manufacturing, Energy, and Water/Wastewater. A successful attack can lead to temporary loss of control and monitoring capabilities, potentially causing process disruptions, safety incidents, or environmental damage. The vulnerability affects devices deployed worldwide. While the S+ Operations node’s overall functionality remains available, the loss of IEC 61850 communication can still impede operations relying on this protocol.

Recommendation

• Apply vendor-provided patches to affected ABB System 800xA and Symphony Plus IEC 61850 products as soon as they are available. Refer to ABB’s advisory for specific version information and patch availability.
• Segment and isolate IEC 61850 networks using firewalls to prevent unauthorized access and lateral movement. Implement strict access control policies to limit access to these networks.
• Monitor network traffic for suspicious IEC 61850 packets that may indicate exploitation attempts. Create network connection rules to only allow traffic from known good IEC 61850 clients.
• Deploy the Sigma rule “Detect Suspicious IEC 61850 Traffic” to detect potential exploitation attempts based on unexpected network activity.
• Enable and review firewall logs to identify and block potentially malicious traffic attempting to reach vulnerable ABB devices.