Most recent entries from csaf_abb

7PAA013309 — System 800xA SECURITY Advisory - ABB 800xA Base 6.0.x, 6.1.x CSLib communication DoS vulnerability

Wed, 05 Jun 2024 00:30:00 +0000

ABB is aware of a vulnerability in the product versions listed as affected in the advisory.

An attacker who successfully exploited this vulnerability could cause services to crash and restart by sending specifically crafted messages.

The vulnerability only affects 800xA services in PC based client/server nodes. Controllers are not affected by this vulnerability

3ADR011377 — AC500 V3 Multiple vulnerabilities

Tue, 07 Jan 2025 00:30:00 +0000

An update is available that resolves a publicly reported vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could call shell functions (CVE-2023-6357), crash the PLC (CVE-2024-5000), crash the web server of the PLC (CVE-2024-8175), grant read access to files (CVE-2024-12429) or enable command execution (CVE-2024-12430). The vulnerabilities CVE-2023-6357, CVE-2024-12429 and CVE-2024-12430 require successful authentication.

SA25P001 — Automation Runtime and mapp View Use of insecure algorithm for self-signed certificates

Wed, 15 Jan 2025 00:30:00 +0000

An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory.

An attacker who successfully exploited this vulnerability may masquerade as services on affected devices.

9AKK108470A5684 — FLXeon Controllers Cyber Security Advisory

Mon, 20 Jan 2025 00:30:00 +0000

An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory.

FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter.

An attacker can successfully exploit these vulnerabilities and could take remote control of the product and potentially insert and run arbitrary code. ABB requires, as noted in previous security advisories and user documentation, that FLXEON should not be exposed to the internet or any other insecure network. Note: In order to exploit an FLXEON, an attacker would need a misconfigured system.

ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library (See in the reference section).

9AKK108470A5466 — Drive Composer Path Traversal Vulnerability

Wed, 05 Feb 2025 00:30:00 +0000

An update is available that resolves vulnerability in the product versions as affected in this advisory. An attacker who successfully exploits the vulnerability could get unauthorized access to the file system on the host machine. This can lead to the execution of arbitrary code, data leakage, or even complete system compromise.

9AKK108470A6775 — Hardcoded credentials in ASPECT Energy Management System

Wed, 05 Feb 2025 00:30:00 +0000

ABB became aware of vulnerabilities in the product versions listed as affected in the advisory. ASPECT devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this already. An attacker who successfully exploits these vulnerabilities could gain unauthorized access and potentially compromise the system's - and log-file - confidentiality, integrity and availability. ABB requires, as noted in previous security advisories and user documentation, that ASPECT should not be exposed to the internet or any other insecure network. Note: In order to exploit an ASPECT, an attacker would need a misconfigured system. ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.

7PAA012159 — System 800xA 5.1.x, 6.0.3.x, 6.1.1.x, 6.2.x - VideONet Camera passwords stored in clear text

Mon, 10 Feb 2025 00:30:00 +0000

ABB is aware of a vulnerability related to the VideONet product. The vulnerability is applicable in the System 800xA versions listed as affected in the advisory, where the VideONet product is used. There will be no update/resolution of this vulnerability in System 800xA. Instead, the strategy for ABB is to offer existing customers using VideONet a transfer to a new product, Camera Connect. This will be offered as soon as Camera Connect is available as a product. An attacker who successfully exploited the vulnerability could, in the worst-case scenario, stop or manipulate the video feed. There is no impact to other Operator station functions (graphics, trends, faceplates, etc.) and Control operations are not impacted at all.

9AKK108470A8565 — RMC-100 Vulnerability in the Web UI (REST Interface)

Tue, 11 Mar 2025 00:30:00 +0000

An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop.

SA24P015 — B&R APROL Potential Privilege Escalation and Information Disclosure

Mon, 24 Mar 2025 00:30:00 +0000

Updates are available that resolve privately reported vulnerabilities in the product versions listed as affected in this advisory.

An attacker who successfully exploits these vulnerabilities could elevate privileges or gather sensitive information.

9AKK108470A9491 — ABB ACS880 +N8010 Drives CODESYS RTS Vulnerabilities

Wed, 26 Mar 2025 00:30:00 +0000

Multiple vulnerabilities regarding the CODESYS Runtime System from CODESYS Group have been publicly reported. CODESYS Runtime System is utilized in the firmware of ABB ACS880 drives to provide IEC 61131-3 programming capabilities.

These vulnerabilities could lead to out-of-bound memory access. Successful exploit may result in a denial-of-service condition or arbitrary code execution. Firmware updates are available that mitigate the publicly reported vulnerabilities of the product versions listed as affected in this advisory.