PT-2018-3326 · Abb · Abb Esoms

Published 2018-08-10 · Updated 2023-05-16 · CVE-2018-14805

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ABB eSOMS version 6.0.2

Description: The issue is related to the incorrect operation of the authentication mechanism in ABB eSOMS. This can allow a remote attacker to gain unauthorized access to the system if LDAP is configured for anonymous authentication and specific key values are present in the eSOMS web.config file. Both conditions must be met for the issue to be exploited.

Recommendations: For ABB eSOMS version 6.0.2, consider disabling anonymous LDAP authentication and review the eSOMS web.config file to ensure that it does not contain the specific key values that can be exploited. Restrict access to the system until a proper fix can be applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2019-04818

CVE-2018-14805

Affected Products

Abb Esoms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2018-14805 · Security Note
• https://bdu.fstec.ru/vul/2019-04818 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14805 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK107046A5821&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://securitylab.ru/news/495381.php · Note
• http://securityfocus.com/bid/105169 · Note
• https://securityfocus.com/bid/105169 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-240-04 · Note
• http://securitylab.ru/vulnerability/495334.php · Note