PT-2016-2331 · Abb · Abb Pcm600

Ilya Karpov · Published 2016-06-09 · Updated 2016-06-17 · CVE-2016-4511

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ABB PCM600 versions prior to 2.7

Description The issue is related to the use of reversible password encryption for passwords stored in the ACTConfig configuration file. This could allow a local attacker to gain access to user passwords. The problem is also described as an improper hash algorithm used for the main application password, making it easier for local users to obtain sensitive information by reading the ACTConfig file.

Recommendations For ABB PCM600 versions prior to 2.7, update to version 2.7 or later to resolve the issue. As a temporary workaround, consider restricting local access to the ACTConfig configuration file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

CWE-321

Related Identifiers

BDU:2016-01720

CVE-2016-4511

Affected Products

Abb Pcm600

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-4511 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4511 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01720 · Security Note
• http://securitylab.ru/lab/PT-2016-08 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02 · Note