{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-6074",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-6074",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-07-03T16:46:11.859Z",
    "updatedAt": "2025-07-03T18:19:47.103Z",
    "importedAt": "2026-10-24T01:57:44.935Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Authentication Bypass to the MQTT configuration Web Interface",
      "summary": "Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE.\n\n\n\nWhen the REST interface is enabled by the user, and an attacker gains access to\nsource code and control network, the attacker can bypass the REST interface authentication and gain access to MQTT configuration data.\n\n\nThis issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015 through 2106229-016.",
      "affected": [
        {
          "vendor": "ABB",
          "product": "RMC-100",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2105457-043",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "2105457-045"
            }
          ]
        },
        {
          "vendor": "ABB",
          "product": "RMC-100 LITE",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2106229-015",
              "status": "affected",
              "versionType": "custom",
              "lessThanOrEqual": "2106229-016"
            }
          ]
        }
      ]
    }
  }
}