PT-2016-2334 · Abb · Abb Pcm600

Ilya Karpov · Published 2016-06-09 · Updated 2016-06-15 · CVE-2016-4527

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ABB PCM600 versions prior to 2.7

Description The issue is related to the storage of authentication information in the database as ASCII hexadecimal values. This could allow a local attacker to gain access to user account information stored in the database files, specifically dBo.PropertyTables. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For ABB PCM600 versions prior to 2.7, update to version 2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the database files to minimize the risk of exploitation. Avoid using the affected database configuration until the issue is resolved.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-255

Related Identifiers

BDU:2016-01723

CVE-2016-4527

Affected Products

Abb Pcm600

References · 5

• https://bdu.fstec.ru/vul/2016-01723 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4527 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4527 · Security Note
• http://securitylab.ru/lab/PT-2016-11 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02 · Note