PT-2023-2102 · Abb · Abb Infinity Dc Power Plant+1

Published 2023-03-16 · Updated 2023-03-24 · CVE-2022-26080

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions ABB Pulsar Plus System Controller NE843 S ABB Infinity DC Power Plant H5692448 G104 ABB Infinity DC Power Plant H5692448 G842 ABB Infinity DC Power Plant H5692448 G224L ABB Infinity DC Power Plant H5692448 G630-4 ABB Infinity DC Power Plant H5692448 G451C(2) ABB Infinity DC Power Plant H5692448 G461(2)

Description The issue is related to the use of insufficiently random values, which can allow a remote attacker to gain unauthorized access to session identifiers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

BDU:2023-01837

CVE-2022-26080

Affected Products

Abb Infinity Dc Power Plant

Abb Pulsar Plus System Controller

References · 6

• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.256117643.1223066510.1678942947-1879524908.1677751217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26080 · Security Note
• https://bdu.fstec.ru/vul/2023-01837 · Security Note
• https://t.me/cvenotify/46767 · Telegram Post
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch · Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-082-05 · Note