PT-2020-20161 · Abb · Spe For Melody+17

Published 2020-04-29 · Updated 2022-10-28 · CVE-2020-8475

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ABB Ability System 800xA versions 5.1 through 6.1 Compact HMI versions 5.1 through 6.0 Control Builder Safe versions 1.0 through 2.0 Symphony Plus -S+ Operations versions 3.0 through 3.2 Symphony Plus -S+ Engineering versions 1.1 through 2.2 Composer Harmony versions 5.1 through 6.1 Melody Composer versions 5.3, 6.1/6.2 SPE for Melody version 1.0SPx Harmony OPC Server (HAOPC) Standalone versions 6.0 through 7.0 ABB Ability System 800xA/ Advant OCS Control Builder A versions 1.3 through 1.4 Advant OCS AC100 OPC Server versions 5.1 through 6.1 Composer CTK versions 6.1 through 6.2 AdvaBuild versions 3.7 SP1 through 3.7 SP2 OPCServer for MOD 300 (non-800xA) version 1.4 OPC Data Link versions 2.1 through 2.2 Knowledge Manager versions 8.0 through 9.1 Manufacturing Operations Management versions 1812 through 1909 ABB Ability SCADAvantage versions 5.1 through 5.6.5

Description A weakness in validation of input exists that allows an attacker to block license handling by sending specially crafted messages to the CLS web service.

Recommendations For ABB Ability System 800xA versions 5.1 through 6.1, update to a version that includes the fix for the input validation weakness. For Compact HMI versions 5.1 through 6.0, update to a version that includes the fix for the input validation weakness. For Control Builder Safe versions 1.0 through 2.0, update to a version that includes the fix for the input validation weakness. For Symphony Plus -S+ Operations versions 3.0 through 3.2, update to a version that includes the fix for the input validation weakness. For Symphony Plus -S+ Engineering versions 1.1 through 2.2, update to a version that includes the fix for the input validation weakness. For Composer Harmony versions 5.1 through 6.1, update to a version that includes the fix for the input validation weakness. For Melody Composer versions 5.3, 6.1/6.2, update to a version that includes the fix for the input validation weakness. For SPE for Melody version 1.0SPx, update to a version that includes the fix for the input validation weakness. For Harmony OPC Server (HAOPC) Standalone versions 6.0 through 7.0, update to a version that includes the fix for the input validation weakness. For ABB Ability System 800xA/ Advant OCS Control Builder A versions 1.3 through 1.4, update to a version that includes the fix for the input validation weakness. For Advant OCS AC100 OPC Server versions 5.1 through 6.1, update to a version that includes the fix for the input validation weakness. For Composer CTK versions 6.1 through 6.2, update to a version that includes the fix for the input validation weakness. For AdvaBuild versions 3.7 SP1 through 3.7 SP2, update to a version that includes the fix for the input validation weakness. For OPCServer for MOD 300 (non-800xA) version 1.4, update to a version that includes the fix for the input validation weakness. For OPC Data Link versions 2.1 through 2.2, update to a version that includes the fix for the input validation weakness. For Knowledge Manager versions 8.0 through 9.1, update to a version that includes the fix for the input validation weakness. For Manufacturing Operations Management versions 1812 through 1909, update to a version that includes the fix for the input validation weakness. For ABB Ability SCADAvantage versions 5.1 through 5.6.5, update to a version that includes the fix for the input validation weakness.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-8475

Affected Products

Abb Ability Scadavantage

Abb Ability System 800Xa

Advabuild

Advant Ocs Ac100 Opc Server

Advant Ocs Control Builder A

Compact Hmi

Composer Ctk

Composer Harmony

Control Builder Safe

Harmony Opc Server (Haopc) Standalone

Knowledge Manager

Manufacturing Operations Management

Melody Composer

Opc Data Link

Opcserver For Mod 300

Spe For Melody

Symphony Plus -S+ Engineering

Symphony Plus -S+ Operations

References · 6

• https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8475 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8475 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launch · Note
• https://t.me/cvenotify/3373 · Telegram Post