PT-2020-15800 · Seeq · S+ Historian+1

Published 2020-12-22 · Updated 2021-10-07 · CVE-2020-24674

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian (affected versions not specified)

Description The issue arises from inadequate user permission checks for certain client commands. As a result, authenticated but unauthorized remote users could potentially execute a Denial-of-Service (DoS) attack, execute arbitrary code, or obtain more privileges than intended on the machines.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2020-24674

Affected Products

S+ Historian

S+ Operations

References · 7

• https://osv.dev/vulnerability/CVE-2020-24674 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24674 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://t.me/cvenotify/7601 · Telegram Post
• https://t.me/cvenotify/7646 · Telegram Post
• https://t.me/cibsecurity/21196 · Telegram Post