CVE-2024-3036

ABB 800xA Base (PC-based client/server nodes) versions 6.0.0 through 6.1.1-2 are affected by CVE-2024-3036, an Improper Input Validation (CWE-20) vulnerability that could crash services by processing specially crafted messages. Reported CVSS scores: v3.1 base 5.7 (AV:A, AC:L, PR:L, UI:N, S:U, A:H...

The vulnerability of the KNX Bus-System microprogramming software components in devices such as ABB Display 55, Display 63, Display 70, RoomTouch 4, BCU KNX allows attackers to exploit these vulnerabilities to gain enhanced privileges.

The vulnerability of the KNX Bus-System microprogramming software components in devices such as ABB Display 55, Display 63, Display 70, RoomTouch 4, and BCU KNX is related to the bypassing of authentication procedures. Exploiting this vulnerability can allow attackers to gain increased privileges...

CVE-2024-4008

FDSK Leak in ABB, Busch-Jaeger, FTS Display version 1.00 and BCU version 1.3.0.33 allows attacker to take control via access to local KNX Bus-System...

CVE-2024-4009

Replay Attack in ABB, Busch-Jaeger, FTS Display version 1.00 and BCU version 1.3.0.33 allows attacker to capture/replay KNX telegram to local KNX Bus-System...

CVE-2024-4008

FDSK Leak in ABB, Busch-Jaeger, FTS Display version 1.00 and BCU version 1.3.0.33 allows attacker to take control via access to local KNX Bus-System...

CVE-2024-4009 Replay Attack in KNX Secure Devices

Replay Attack in ABB, Busch-Jaeger, FTS Display version 1.00 and BCU version 1.3.0.33 allows attacker to capture/replay KNX telegram to local KNX Bus-System...

CVE-2024-4008 FDSK Leak in KNX Secure Devices

FDSK Leak in ABB, Busch-Jaeger, FTS Display version 1.00 and BCU version 1.3.0.33 allows attacker to take control via access to local KNX Bus-System...

ABB 800xA Base (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION : Low attack complexity Vendor : ABB Equipment : 800xA Base Vulnerabilities : Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause services to crash and restart. 3. TECHNICAL DETAILS 3.1...

PT-2024-4065

Name of the Vulnerable Software and Affected Versions: ABB Display versions 1.00 BCU version 1.3.0.33 ABB Display 55 affected versions not specified ABB Display 63 affected versions not specified ABB Display 70 affected versions not specified RoomTouch 4 affected versions not specified Descriptio...

PT-2024-6689 · Abb · Abb Aspect +2

Name of the Vulnerable Software and Affected Versions: ABB ASPECT - Enterprise versions 3.08.01 ABB NEXUS Series versions 3.08.01 ABB MATRIX Series versions 3.08.01 Description: An unauthorized file access issue exists in the WEB Server of ABB ASPECT - Enterprise, NEXUS Series, and MATRIX Series...

CVE-2024-0335

ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products e.g., S+ Operations, S+ Engineering and S+ Analyst This issue affects Symphony Plus S+ Operations: from 3..0;0 through 3.3 SP1 RU4, from 2.1;0...

CVE-2024-0335

CVE-2024-0335 concerns ABB Symphony Plus S+ products (Operations, Engineering, Analyst) with a vulnerability in the ABB VPNI feature of the S+ Control API. The issue stems from errors in processing relative paths within VPNI, which can enable denial of service. Affected versions include S+ Operat...

CVE-2024-0335 Malformed Packet Handling

ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products e.g., S+ Operations, S+ Engineering and S+ Analyst This issue affects Symphony Plus S+ Operations: from 3..0;0 through 3.3 SP1 RU4, from 2.1;0...

CVE-2024-0335 Malformed Packet Handling

ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products e.g., S+ Operations, S+ Engineering and S+ Analyst This issue affects Symphony Plus S+ Operations: from 3..0;0 through 3.3 SP1 RU4, from 2.1;0...

Hitachi Energy RTU500 series CMU Buffer Copy Without Checking Size of Input (CVE-2023-6711)

Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an...

Hitachi Energy RTU500 Series Improper Validation of Specified Index, Position, or Offset in Input (CVE-2023-5768)

A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Incomplete or wrong received APDU frame layout may cause blocking on link layer. Error reason was an endless blocking when reading incoming frames on link layer with wrong length...

Hitachi Energy Relion 670/650/SAM600-IO Series Improper Validation of Specified Quantity in Input (CVE-2023-4518)

A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a reboot of the device. In order for an attacker to exploit the vulnerability, goose receiving blocks need to be configured. This plugin only works with...

Hitachi Energy RTU500 Series Improper Neutralization of Input During Web Page Generation (CVE-2023-5769)

A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross- site scripting on the webserver due to user input being improperly sanitized. This plugin only works with Tenable.ot. Please visit...

Hitachi Energy RTU500 Series Improper Neutralization of Input During Web Page Generation (CVE-2023-5767)

A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cross- site scripting on the webserver due to an RDT language file being improperly sanitized. This plugin only works with Tenable.ot. Please visit...

ABB RTU500 Series Out-of-bounds Read in embedded OpenSSL (CVE-2021-3712)

A vulnerability exists in the OpenSSL Version 1.0.2 that affects the RTU500 Series product versions listed below. RTU500 series CMU Firmware versions 12.0.1 – 12.0.14 12.2.1 – 12.2.11 12.4.1 – 12.4.11 12.6.1 – 12.6.8 12.7.1 – 12.7.5 13.2.1 – 13.2.5 13.3.1 – 13.3.3 13.4.1 ASN.1 strin...