CVE-2016-4527

ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors...

CVE-2016-4511: Undefined Security Weakness

ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sensitive cleartext information by leveraging read access to the ACTConfig configuration file...

CVE-2016-4527: Undefined Security Weakness

ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors...

CVE-2016-4516: Exposure of Sensitive Information to an Unauthorized Actor

ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via unspecified vectors...

CVE-2016-4524: Improper Access Control

ABB PCM600 before 2.7 improperly stores OPC Server IEC61850 passwords in unspecified temporary circumstances, which allows local users to obtain sensitive information via unknown vectors...

PT-2016-2333

Name of the Vulnerable Software and Affected Versions ABB PCM600 versions prior to 2.7 Description The issue is related to the improper storage of OPC Server IEC61850 passwords in temporary circumstances, allowing local users to obtain sensitive information. The vulnerability is associated with t...

PT-2016-2332

Name of the Vulnerable Software and Affected Versions ABB PCM600 versions prior to 2.7 Description The issue is related to the improper storage of the main application password after a password change, allowing local users to obtain sensitive information. The password is stored in an unencrypted...

PT-2016-2331

Name of the Vulnerable Software and Affected Versions ABB PCM600 versions prior to 2.7 Description The issue is related to the use of reversible password encryption for passwords stored in the ACTConfig configuration file. This could allow a local attacker to gain access to user passwords. The...

PT-2016-2334

Name of the Vulnerable Software and Affected Versions ABB PCM600 versions prior to 2.7 Description The issue is related to the storage of authentication information in the database as ASCII hexadecimal values. This could allow a local attacker to gain access to user account information stored in...

ABB PCM600 Credential Protection Vulnerability (CNVD-2016-03749)

The ABB PCM600 is a protection and control IED manager, primarily used in the energy industry. A vulnerability exists in the way the ABB PCM600 authentication credentials are saved. A local attacker could exploit this vulnerability to gain access to the affected device...

ABB PCM600 Credential Protection Vulnerability

The ABB PCM600 is a protection and control IED manager, primarily used in the energy industry. A vulnerability exists in the way the ABB PCM600 OPC Server IEC61850 authentication password is temporarily protected. A local attacker could exploit this vulnerability to access the affected device...

ABB PCM600 Vulnerabilities

OVERVIEW ABB has identified one use of password hash with insufficient computational effort and three insufficiently protected credentials vulnerabilities in ABB’s PCM600. These vulnerabilities were reported directly to ABB by Ilya Karpov from Positive Technologies. ABB has produced a new version...

PT-2016-11: Insecure Authentication Data Storage in ABB PCM600

The specialists of the Positive Research center have detected an Insecure Password Storage vulnerability in ABB PCM600. PCM600 authentication accounts are stored as ASCII hex values in the manual program DB files. An attacker can get access to PCM600. How to fix Update your software up to the...

PT-2016-09: Password Access in ABB PCM600

The specialists of the Positive Research center have detected a Password Access vulnerability in ABB PCM600. After you change the Main Application Password, it is stored to the configuration file as a clear text. How to fix Update your software up to the latest version Advisory status 09.06.2015 ...

PT-2016-08: Weak Password Hashing in ABB PCM600

The specialists of the Positive Research center have detected a Weak password hashing vulnerability in ABB PCM600. A Main Application Password in the "ACTConfig" configuration file hashed by the weak function with the hardcoded key and the initialization vector. It is easy to decrypt the password...

PT-2015-7963

Уязвимость файла конфигурации «ACTConfig» средства контроля и конфигурирования энергоустановок ABB PCM600 связана с недостаточным вычислением хеша пароля при помощи ненадежной функции с жестко закодированным ключом и вектором инициализации. Эксплуатация уязвимости может позволить нарушителю,...

PT-2016-10: Insecure Password Storage in ABB PCM600

The specialists of the Positive Research center have detected an Insecure Password Storage vulnerability in ABB PCM600. The OPC Server IEC61850 authentication password is stored as a clear text in the configuration file and manual project. As a result an attacker can get access to the IEC61850...