ABB Ability Zenon ships with a MongoDB version that hasn't been patched since 2020

Key points

• ABB's Ability Zenon industrial software ships with MongoDB 4.2, a database version carrying flaws that let attackers read memory or sidestep access rules.
• The most serious flaw, CVE-2025-14847, scores 8.7 out of 10 and can be triggered by an attacker with no login at all.
• Zenon is deployed worldwide across chemical plants, water utilities, energy, healthcare and communications networks.
• ABB is not shipping a fix inside Zenon; it tells customers to swap in a supported MongoDB themselves or remove the affected feature.
• The advisory was published by CISA, the US Cybersecurity and Infrastructure Security Agency, based on ABB's own security notice.

Switzerland-based ABB has told customers that a bundled database inside its Ability Zenon industrial software carries a set of security flaws, some of them five years old.

Zenon is what engineers call a SCADA product, meaning software that monitors and controls the machinery inside factories, power stations and water treatment plants. Alongside the main software, ABB ships an optional feature called IIoT Services, which stores data in a copy of MongoDB, a popular open-source database.

The copy it ships is MongoDB 4.2. That version has been out of support for a long time, and never received the patches for the bugs now flagged in the advisory from the US Cybersecurity and Infrastructure Security Agency.

What can attackers actually do?

They can read chunks of the server's memory, and in some cases slip past network restrictions meant to keep the database private. None of the listed flaws grant instant remote takeover, but they weaken the walls around systems that run critical plants.

The headline bug is CVE-2025-14847, rated 8.7 on the newer CVSS 4.0 severity scale. A mismatch in how MongoDB handles compressed network traffic lets an attacker with no account send a crafted message and read leftover data from the server's memory. That data could include fragments of queries, credentials or configuration.

Two older bugs make the picture worse. CVE-2020-7928 lets a logged-in user trigger a similar memory read through a specially built database query. CVE-2020-7921 lets someone with valid credentials bypass IP allow-lists, the network rules meant to restrict who can connect at all.

Who runs this software?

Operators of physical infrastructure, in dozens of countries. CISA lists the affected sectors as chemical, communications, critical manufacturing, dams, energy, healthcare, information technology, and water and wastewater. Zenon is deployed worldwide.

That is the part that matters beyond the CVE numbers. Memory-read bugs in a business web app are one thing. The same bugs sitting inside a water utility's control network are a different conversation.

The affected pieces at a glance

Is there a patch?

Not from ABB, not inside Zenon itself. The vendor is telling customers to do one of two things.

If they need IIoT Services, they should replace the bundled MongoDB 4.2 with a current, supported release, following the instructions in ABB's own zenon help documentation. If they do not need IIoT Services, ABB says to remove the feature entirely from the Windows Control Panel, which takes the vulnerable database off the machine.

ABB has published a security advisory under reference 9AKK108472A9037 with the full instructions.

What should ordinary people do?

Nothing directly. Zenon is not consumer software. The risk sits with the operators of plants and utilities that run it, and with the engineering firms that install it. If you work in one of those environments, the practical step this week is to check whether IIoT Services is turned on, and whether the MongoDB copy behind it has ever been replaced.

At the time of writing, there are no public reports of these flaws being used against Zenon deployments in the wild.