ABB Pulsar Plus Controller

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: ABB Equipment: Pulsar Plus Controller Vulnerabilities: Use of Insufficiently Random Values, Cross-Site Request Forgery CSRF 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...

CVE-2022-3192

Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6...

Input validation

Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6...

CVE-2022-3192 Improper Check for Unusual or Exceptional Conditions

Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6...

CVE-2022-3192

CVE-2022-3192 affects ABB AC500 V2 PM5xx (AC500 V2) with versions 2.0.0 up to, but not including, 2.8.6. The issue is improper input validation that enables client–server protocol manipulation, leading to potential availability impact. Public documentation in the connected records confirms the af...

CVE-2022-3192 Improper Check for Unusual or Exceptional Conditions

Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6...

CVE-2023-1258

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware web service modules allows Footprinting.This issue affects Flow-X: before 4.0...

Code injection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware web service modules allows Footprinting.This issue affects Flow-X: before 4.0...

CVE-2023-1258 Flow-X disclosure of sensitive information to unauthenticated users

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware web service modules allows Footprinting.This issue affects Flow-X: before 4.0...

CVE-2023-1258

CVE-2023-1258 affects ABB Flow-X firmware (Flow-X embedded hardware, web service modules). The root cause is insufficient protection of service data in the web service modules, leading to exposure of sensitive information to unauthenticated actors and enabling footprinting. Affected versions are ...

CVE-2023-1258 Flow-X disclosure of sensitive information to unauthenticated users

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware web service modules allows Footprinting.This issue affects Flow-X: before 4.0...

ABB CP600 HMI Download of Code Without Integrity Check (CVE-2019-7229)

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: Utilization of USB/SD Card to flash the device and Remote provisioning process via ABB Panel Builder 600 over FTP. Neither of these transmission methods implements any form of encryption...

ABB Central Licensing System Permissions, Privileges, and Access Controls (CVE-2020-8476)

For the Central Licensing Server component used in ABB products ABB Ability System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8486)

Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling. This plugin only works with Tenable.ot. Please visit...

ABB OPC Server for Incorrect Permission Assignment for Critical Resource (CVE-2021-22284)

Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running the AC800M OPC Server. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8484)

Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash. This plugin only works wi...

ABB Central Licensing System Improper Restriction of XML External Entity Reference (CVE-2020-8479)

For the Central Licensing Server component used in ABB products ABB Ability System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8488)

Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management all published versions enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities. Th...

ABB System 800xA Incorrect Default Permissions (CVE-2020-8473)

Insufficient folder permissions used by system functions in ABB System 800xA Base version 6.1 and earlier allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploit the vulnerabilities could escalate his/her...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8485)

Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash. This plugin only work...