PT-2020-15802 · Abb · Symphony Plus Historian+1

Published 2020-12-22 · Updated 2021-09-14 · CVE-2020-24676

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symphony Plus Operations (affected versions not specified) Symphony Plus Historian (affected versions not specified)

Description The issue allows an unprivileged but authenticated user to execute arbitrary code, potentially resulting in privilege escalation. This depends on the user that the service runs as.

Recommendations For Symphony Plus Operations, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Symphony Plus Historian, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-274

Related Identifiers

CVE-2020-24676

Affected Products

Symphony Plus Historian

Symphony Plus -S+ Operations

References · 6

• https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24676 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24676 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://t.me/cvenotify/7599 · Telegram Post
• https://t.me/cibsecurity/21204 · Telegram Post