7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
74.6%
Successful exploitation of this vulnerability could allow a remote attacker to bypass authentication and extract credentials from the device.
The following versions of Power Generation Information Manager (PGIM) and Plant Connect monitoring platforms are affected:
The affected product is vulnerable to authentication bypass, which may allow an attacker to remotely bypass authentication and extract credentials from the affected device.
CVE-2019-18250 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Rikard Bodforss of Bodforss Consulting reported this vulnerability to ABB.
ABB reports PGIM will transition to a limited support phase in January, 2020, and Plant Connect is already obsolete.
Users are advised to upgrade to Symphony Plus Historian, which is not affected by this vulnerability. Symphony Plus Historian is the successor to the PGIM and Plant Connect products and features improved cybersecurity.
ABB further recommends users of PGIM not use the same credentials for Windows login as used to log into the PGIM and Plant Connect applications. Additionally, end users who cannot immediately upgrade should consider protecting network communication by use of IPSec or other means. Users should contact ABB for additional support details.
For additional instructions and support, please contact ABB service at: <https://new.abb.com/contact-centers>
Information about ABB’s cybersecurity program and capabilities can be found at: <http://www.abb.com/cybersecurity>
For more information, see ABB’s security advisory 8VZZ002158.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
No known public exploits specifically target this vulnerability.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18250
www.abb.com/cybersecurity
cwe.mitre.org/data/definitions/288.html
new.abb.com/contact-centers
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
search.abb.com/library/Download.aspx?DocumentID=8VZZ002158T0001&LanguageCode=en&DocumentPartId=&Action=Launch
twitter.com/CISAgov
twitter.com/intent/tweet?text=ABB%20Power%20Generation%20Information%20Manager%20%28PGIM%29%20and%20Plant%20Connect+https://www.cisa.gov/news-events/ics-advisories/icsa-19-318-05
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-19-318-05&title=ABB%20Power%20Generation%20Information%20Manager%20%28PGIM%29%20and%20Plant%20Connect
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-19-318-05
www.oig.dhs.gov/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-advisories/icsa-19-318-05
www.us-cert.gov/ics
www.us-cert.gov/ics
www.us-cert.gov/ics/alerts/ICS-ALERT-10-301-01
www.us-cert.gov/ics/recommended-practices
www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B
www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=ABB%20Power%20Generation%20Information%20Manager%20%28PGIM%29%20and%20Plant%20Connect&body=www.cisa.gov/news-events/ics-advisories/icsa-19-318-05
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
74.6%