PT-2019-2564 · Abb · Abb Cp635+15

Published 2019-06-05 · Updated 2022-01-01 · CVE-2019-7229

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ABB CP620 version 1SAP520100R0001 ABB CP620 version 1SAP520100R4001 ABB CP620-WEB version 1SAP520200R0001 ABB CP630 version 1SAP530100R0001 ABB CP630-WEB version 1SAP530200R0001 ABB CP635 version 1SAP535100R0001 ABB CP635 version 1SAP535100R5001 ABB CP635-B version 1SAP535100R2001 ABB CP635-WEB version 1SAP535200R0001 ABB CP651 version 1SAP551100R0001 ABB CP651-WEB version 1SAP551200R0001 ABB CP661 version 1SAP561100R0001 ABB CP661-WEB version 1SAP561200R0001 ABB CP665 version 1SAP565100R0001 ABB CP665-WEB version 1SAP565200R0001 ABB CP676 version 1SAP576100R0001 ABB CP676-WEB version 1SAP576200R0001

Description The issue is related to the lack of technical measures to protect information during the upgrade of software components via USB/SD card or remote initialization using ABB Panel Builder 600 over FTP. This allows a remote attacker to gain unauthorized access to protected information. The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and software components, neither of which implements encryption or authenticity checks against the new firmware HMI software binary files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-494

CWE-295

Related Identifiers

BDU:2019-02432

CVE-2019-7229

Affected Products

Abb Cp620

Abb Cp620-Web

Abb Cp630

Abb Cp630-Web

Abb Cp635

Abb Cp635-B

Abb Cp635-Web

Abb Cp651

Abb Cp651-Web

Abb Cp661

Abb Cp661-Web

Abb Cp665

Abb Cp665-Web

Abb Cp676

Abb Cp676-Web

Abb Panel Builder 600

References · 9

• 🔥 https://darkmatter.ae/xen1thlabs/abb-hmi-absence-of-signature-verification-vulnerability-xl-19-005 · Exploit
• 🔥 http://packetstormsecurity.com/files/153387/ABB-HMI-Missing-Signature-Verification.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/Jun/34 · Exploit
• https://bdu.fstec.ru/vul/2019-02432 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=3ADR010402&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7229 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7229 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=3ADR010376&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://securitylab.ru/news/499635.php · Note