ABB Ability Zenon ships with a MongoDB version that hasn't been patched since 2020

Key points

• ABB's Ability Zenon industrial software ships with MongoDB 4.2, a database version carrying flaws that let attackers read memory or sidestep access rules.
• The most serious flaw, CVE-2025-14847, scores 8.7 out of 10 and can be triggered by an attacker with no login at all.
• Zenon is deployed worldwide across chemical plants, water utilities, energy and healthcare networks.
• ABB isn't shipping a fix inside Zenon; customers must swap in a supported MongoDB themselves or remove the affected feature.
• The advisory was published by CISA, the US Cybersecurity and Infrastructure Security Agency, drawing on ABB's own security notice.

Switzerland-based ABB has told customers that a bundled database inside its Ability Zenon industrial software carries a set of security flaws, some of them five years old.

Zenon is what engineers call a SCADA product: software that monitors and controls machinery inside factories and power stations, water treatment plants. Alongside the main software, ABB ships an optional feature called IIoT Services, which stores data in a copy of MongoDB, a popular open-source database. The copy it ships is MongoDB 4.2, a version that never received patches for the bugs now flagged in the CISA advisory.

What can attackers actually do?

They can read chunks of the server's memory and, in some cases, slip past network restrictions meant to keep the database private. None of the listed flaws grant instant remote takeover, but they weaken the walls around systems that run critical plants.

The headline bug is CVE-2025-14847, rated 8.7 on the CVSS 4.0 severity scale. A mismatch in how MongoDB handles compressed network traffic lets an unauthenticated attacker send a crafted message and read leftover data from the server's memory, potentially including query fragments or credentials.

Two older bugs compound the risk. CVE-2020-7928 lets a logged-in user trigger a similar memory read through a specially built database query. CVE-2020-7921 allows someone with valid credentials to bypass IP allow-lists, the network rules that restrict who can connect.

Who runs this software?

Operators of physical infrastructure, in dozens of countries. CISA lists the affected sectors as chemical, communications, critical manufacturing, dams, energy, healthcare and public health, information technology, and water and wastewater. Zenon is deployed worldwide.

That context matters far beyond the CVE numbers. The attack on more than 30 Minnesota water utilities on 26 July, which we reported, shows how quickly control-network compromises become public-safety events. Memory-read bugs in a business web app are one thing; the same bugs sitting inside a water utility's control network are a different conversation entirely.

The affected pieces at a glance

Is there a patch?

There isn't one from ABB inside Zenon itself. Customers who need IIoT Services should replace the bundled MongoDB 4.2 with a current, supported release following ABB's zenon help documentation. Those who don't need IIoT Services can remove it via the Windows Control Panel, which takes the vulnerable database off the machine entirely. ABB's full instructions are in security advisory 9AKK108472A9037.

Should you worry?

Not if you're a consumer: Zenon isn't consumer software. The risk sits with operators of plants and utilities that run it, and with the engineering firms that install it. If you work in one of those environments, the practical step right now is to check whether IIoT Services is running and whether the MongoDB instance behind it has ever been replaced.

At the time of writing, there are no public reports of these flaws being exploited against Zenon deployments in the wild.