ABB Pulsar Plus Controller

🗓️ 31 Mar 2023 19:07:05Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics

ics🔗 www.cisa.gov👁 53 Views

ABB Pulsar Plus Controller, Vulnerabilities: Insufficiently Random Values, Cross-Site Request Forgery, fix available

Reporter	Title	Published	Views	Family All 22
BDU FSTEC	The vulnerability of software and hardware components in SCADA systems, such as ABB Pulsar Plus System Controller NE843_S, Infinity DC Power Plant H5692448 G104, Infinity DC Power Plant H5692448 G842, Infinity DC Power Plant H5692448 G224L, Infinity DC Power Plant H5692448 G630-4, Infinity DC Power Plant H5692448 G451C(2), Infinity DC Power Plant H5692448 G461(2), arises due to the use of insufficiently random values. This vulnerability allows unauthorized individuals to gain unauthorized access to session identifiers.	4 Apr 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the software and hardware components of SCADA systems, such as the ABB Pulsar Plus System Controller NE843_S, Infinity DC Power Plant H5692448 G104, Infinity DC Power Plant H5692448 G842, Infinity DC Power Plant H5692448 G224L, Infinity DC Power Plant H5692448 G630-4, Infinity DC Power Plant H5692448 G451C(2), Infinity DC Power Plant H5692448 G461(2), arises due to insufficient validation of input data. This vulnerability allows attackers to execute CSRF attacks.	4 Jul 202300:00	–	bdu_fstec
Circl	CVE-2022-1607	5 May 202321:08	–	circl
Circl	CVE-2022-26080	26 Feb 202515:26	–	circl
CNNVD	Pulsar Plus System Controller 跨站请求伪造漏洞	24 Feb 202300:00	–	cnnvd
CNNVD	Pulsar Plus System Controller 安全特征问题漏洞	16 Mar 202300:00	–	cnnvd
CVE	CVE-2022-1607	24 Feb 202304:49	–	cve
CVE	CVE-2022-26080	16 Mar 202312:53	–	cve
Cvelist	CVE-2022-1607 Cross Site Scripting vulnerability in NE843 Pulsar Plus Controller	24 Feb 202304:49	–	cvelist
Cvelist	CVE-2022-26080 Easily guessable session ID's in NE843 Pulsar Plus Controller	16 Mar 202312:53	–	cvelist

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-082-05.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-082-05
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
us-cert	www.us-cert.cisa.gov/ics/Recommended-Practices
cisa	www.cisa.gov/ics
cisa	www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
cisa	www.cisa.gov/uscert/ncas/tips/ST04-014

31 Mar 2023 19:07Current

7.8High risk

Vulners AI Score7.8

CVSS 3.16.3 - 8.8

EPSS0.0024

SSVC

cvss v3 6.3 remote exploit abb pulsar plus controller cross-site request forgery use of insufficiently random values abb infinity dc power plant abb pulsar plus system controller cve-2022-1607 cve-2022-26080 critical infrastructure sectors worldwide deployment switzerland facebook red team x vulnerability update firewall protection read/write enable/disable abb security advisory