Design/Logic Flaw

The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing HMISimulator to denial of service via crafted HTTP requests manipulating the content-length setting...

Design/Logic Flaw

Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty .JPR application file. An attacker with access to the file system might be able to cause application malfunction such as denial of service...

Path traversal

Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s context...

Path traversal

The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISimulator versions 2.8.0.424 and earlier potentially allows access to files outside of the working directory, thus potentially supporting...

CVE-2019-18996

ABB PB610 Panel Builder 600’s HMIStudio component (versions ≤ 2.8.0.424) is affected by a DLL-loading vulnerability: path settings accept DLLs outside the program directory, potentially allowing a local attacker to execute code in the application's context. This is reported across multiple source...

CVE-2019-18996 ABB PB610 HMIStudio accepts malicious DLL file in an application

Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s context...

CVE-2019-18997 PB610 HMISimulator provides interface with access to arbitrary files

The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISimulator versions 2.8.0.424 and earlier potentially allows access to files outside of the working directory, thus potentially supporting...

CVE-2019-18997

ABB PB610 Panel Builder 600's HMISimulator component exposes a path traversal vulnerability. In PB610 HMISimulator versions 2.8.0.424 and earlier, the readFile/writeFile interface can manipulate the work file in a way that may allow access to files outside the working directory, enabling unauthor...

CVE-2019-18994 ABB PB610 HMIStudio crashes after launching an empty *.JPR application file

Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty .JPR application file. An attacker with access to the file system might be able to cause application malfunction such as denial of service...

CVE-2019-18994

CVE-2019-18994 affects ABB PB610 Panel Builder 600 HMIStudio component. The vulnerability arises from a lack of file length checks, causing crashes when loading an empty *.JPR application file in versions 2.8.0.424 and earlier. Impact described: application malfunction/denial of service if an att...

CVE-2019-18995 ABB PB610 HMISimulator does not check content-length of the HTTP request

The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing HMISimulator to denial of service via crafted HTTP requests manipulating the content-length setting...

CVE-2019-18995

The CVE-2019-18995 issue affects ABB PB610 Panel Builder 600 HMISimulator component, specifically versions 2.8.0.424 and earlier. The root cause is that the HMISimulator fails to validate the HTTP Content-Length header, allowing crafted HTTP requests to trigger a denial-of-service condition. Mult...

icsmaster

This repository, 'icsmaster', is an ICS/SCADA security resource collection. It contains various tools and scripts for identifying and exploiting vulnerabilities in industrial control systems. The repository includes a list of dorks search terms for finding vulnerable systems, as well as a...

ABB PB610 Multiple Security Vulnerabilities

Description ABB PB610 Panel Builder 600 is prone to the following vulnerabilities: 1. Multiple denial-of-service vulnerabilities 2. An arbitrary code-execution vulnerability 3. An unauthorized file-access vulnerability Attackers can exploit these issues to execute arbitrary code, access or read...

Authentication flaw

In all versions of ABB Power Generation Information Manager PGIM and Plant Connect, the affected product is vulnerable to authentication bypass, which may allow an attacker to remotely bypass authentication and extract credentials from the affected device...

ABB Relion 650 and 670 Series CVE-2019-18247 Denial Of Service Vulnerability

Description ABB Relion 650 and 670 Series are prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a device to reboot, denying service to legitimate users. The following versions of ABB Relion series are vulnerable: ABB Relion 650 series versions 1.3.0.5 and prior...

ABB Relion 670 Series

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: Relion 670 Series Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to read and delete files on the device. 3...

ABB Relion 650 and 670 Series

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: Relion 650 and 670 Series Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to reboot the device,...

CVE-2019-18250

CVE-2019-18250 affects ABB Power Generation Information Manager (PGIM) and Plant Connect. The vulnerability is an authentication bypass that could allow a remote attacker to bypass authentication and extract credentials from the device. Affected products are PGIM (all versions) and Plant Connect ...

ABB Power Generation Information Manager (PGIM) and Plant Connect Security Authentication Bypass Vulnerability

ABB Power Generation Information Manager is the power generation information management system of the ABB Group. A security authentication bypass vulnerability exists in ABB Power Generation Information Manager PGIM and Plant Connect, which can be exploited by an attacker to bypass authentication...