PT-2019-2566 · Abb · Abb Idal Ftp Server

Published 2019-06-13 · Updated 2022-12-01 · CVE-2019-7227

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ABB IDAL FTP server (affected versions not specified)

Description The issue allows an authenticated attacker to traverse to arbitrary directories on the hard disk using the CWD ../ command and then use the FTP server functionality to download and upload files. An unauthenticated attacker can exploit the hardcoded or default credential pair exor/exor to become an authenticated attacker. This can lead to unauthorized access to information and disruption of its integrity by copying and overwriting files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-02434

CVE-2019-7227

Affected Products

Abb Idal Ftp Server

References · 11

• 🔥 https://darkmatter.ae/xen1thlabs/abb-idal-ftp-server-path-traversal-vulnerability-xl-19-008 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2019/Jun/37 · Exploit
• 🔥 http://packetstormsecurity.com/files/153396/ABB-IDAL-FTP-Server-Path-Traversal.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7227 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02434 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7227 · Vendor Advisory
• http://securityfocus.com/bid/108886 · Note
• https://t.me/cvenotify/38822 · Telegram Post
• https://securitylab.ru/news/499635.php · Note
• https://search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch · Note