This vulnerability (CVE-2025-14773) affects ABB T-MAC Plus version 4.0-24 and is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting). It allows an attacker with low complexity and limited privileges, requiring user interaction, to potentially execute arbitrary code or scripts in the context of the vulnerable web application. The CVSS v3.1 base score is 8.0, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is not in a cloud service and no official remediation or patch has been published by ABB as of the provided data.

Successful exploitation could lead to high impact on confidentiality, integrity, and availability of the affected system due to arbitrary code execution via XSS. This could allow attackers to steal sensitive information, manipulate data, or disrupt service. However, exploitation requires user interaction and low privileges, which somewhat limits the attack vector. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply general best practices for mitigating XSS vulnerabilities such as input validation and output encoding where possible. Monitor ABB's official channels for updates and patches. No vendor advisory or official fix is currently available.