PT-2021-11066 · Abb · Ac500

Published 2021-02-26 · Updated 2021-03-05 · CVE-2020-24686

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: ABB AC500 V2 products with onboard Ethernet (affected versions not specified)

Description: The issue can be exploited to cause the web visualization component of the PLC to stop and not respond, leading to genuine users losing remote visibility of the PLC state. If a user attempts to login to the PLC while this issue is exploited, the PLC will show an error state and refuse connections to Automation Builder. The execution of the PLC application is not affected by this issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-24686

Affected Products

Ac500

References · 4

• https://search.abb.com/library/Download.aspx?DocumentID=3ADR010645&LanguageCode=en&DocumentPartId=&Action=Launch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24686 · Security Note
• https://t.me/cvenotify/10930 · Telegram Post
• https://t.me/cibsecurity/24221 · Telegram Post