PT-2016-2332 · Abb · Abb Pcm600

Ilya Karpov · Published 2016-06-09 · Updated 2016-06-15 · CVE-2016-4516

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ABB PCM600 versions prior to 2.7

Description The issue is related to the improper storage of the main application password after a password change, allowing local users to obtain sensitive information. The password is stored in an unencrypted form in the configuration file, which can be accessed by analyzing the file before the user commands it to be hashed. This allows a local attacker to gain access to user passwords.

Recommendations For ABB PCM600 versions prior to 2.7, update to version 2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration file to minimize the risk of exploitation. Additionally, users should be cautious when handling password changes to avoid potential unauthorized access to sensitive information.

Fix

Information Disclosure

Weakness Enumeration

CWE-256

CWE-200

Related Identifiers

BDU:2016-01721

CVE-2016-4516

Affected Products

Abb Pcm600

References · 5

• https://bdu.fstec.ru/vul/2016-01721 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4516 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4516 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02 · Note
• http://securitylab.ru/lab/PT-2016-09 · Note