PT-2020-20165 · Abb · Spe For Melody+15

Published 2020-04-29 · Updated 2021-09-14 · CVE-2020-8481

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ABB Ability System 800xA versions 5.1 through 6.1 Compact HMI versions 5.1 through 6.0 Control Builder Safe versions 1.0 through 2.0 Symphony Plus -S+ Operations versions 3.0 through 3.2 Symphony Plus -S+ Engineering versions 1.1 through 2.2 Composer Harmony versions 5.1 through 6.1 Melody Composer versions 5.3, 6.1/6.2 SPE for Melody version 1.0SPx Harmony OPC Server (HAOPC) Standalone versions 6.0 through 7.0 ABB Ability System 800xA/ Advant OCS Control Builder A versions 1.3 through 1.4 Advant OCS AC100 OPC Server versions 5.1 through 6.1 Composer CTK versions 6.1 through 6.2 AdvaBuild versions 3.7 SP1 through 3.7 SP2 OPCServer for MOD 300 (non-800xA) version 1.4 OPC Data Link versions 2.1 through 2.2 Knowledge Manager versions 8.0 through 9.1 Manufacturing Operations Management versions 1812 through 1909

Description Confidential data is written in an unprotected file, allowing an attacker who successfully exploits this issue to take full control of the computer.

Recommendations For ABB Ability System 800xA versions 5.1 through 6.1, update to a version that fixes the issue. For Compact HMI versions 5.1 through 6.0, update to a version that fixes the issue. For Control Builder Safe versions 1.0 through 2.0, update to a version that fixes the issue. For Symphony Plus -S+ Operations versions 3.0 through 3.2, update to a version that fixes the issue. For Symphony Plus -S+ Engineering versions 1.1 through 2.2, update to a version that fixes the issue. For Composer Harmony versions 5.1 through 6.1, update to a version that fixes the issue. For Melody Composer versions 5.3, 6.1/6.2, update to a version that fixes the issue. For SPE for Melody version 1.0SPx, update to a version that fixes the issue. For Harmony OPC Server (HAOPC) Standalone versions 6.0 through 7.0, update to a version that fixes the issue. For ABB Ability System 800xA/ Advant OCS Control Builder A versions 1.3 through 1.4, update to a version that fixes the issue. For Advant OCS AC100 OPC Server versions 5.1 through 6.1, update to a version that fixes the issue. For Composer CTK versions 6.1 through 6.2, update to a version that fixes the issue. For AdvaBuild versions 3.7 SP1 through 3.7 SP2, update to a version that fixes the issue. For OPCServer for MOD 300 (non-800xA) version 1.4, update to a version that fixes the issue. For OPC Data Link versions 2.1 through 2.2, update to a version that fixes the issue. For Knowledge Manager versions 8.0 through 9.1, update to a version that fixes the issue. For Manufacturing Operations Management versions 1812 through 1909, update to a version that fixes the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-922

Related Identifiers

CVE-2020-8481

Affected Products

Abb Ability System 800Xa

Advabuild

Advant Ocs Ac100 Opc Server

Advant Ocs Control Builder A

Compact Hmi

Composer Ctk

Composer Harmony

Control Builder Safe

Harmony Opc Server

Knowledge Manager

Manufacturing Operations Management

Melody Composer

Opc Data Link

Opcserver For Mod 300

Spe For Melody

Symphony Plus

References · 5

• https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8481 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8481 · Vendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://t.me/cvenotify/3377 · Telegram Post