PT-2024-10763 · Microsoft+1 · Windows+1

Published 2024-07-23 · Updated 2024-07-24 · CVE-2020-11639

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advant MOD 300 AdvaBuild versions 3.0 through 3.7 SP2

Description An attacker could exploit the issue by injecting specially crafted data, potentially causing a denial-of-service attack through process crashes or communication issues on the affected node. The attacker could also tamper with transmitted data, leading to incorrect information being stored, acted upon, or displayed. To be successful, the attacker must have local access to a node in the system and be able to start a specially crafted application that disrupts communication. A successful exploitation could allow an attacker to manipulate data, enabling reads and writes to controllers or causing Windows processes in 800xA for MOD 300 and AdvaBuild to crash.

Recommendations For Advant MOD 300 AdvaBuild versions 3.0 through 3.7 SP2, consider restricting local access to nodes in the system and limiting the ability to start specially crafted applications that could disrupt communication as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-924

Related Identifiers

CVE-2020-11639

Affected Products

Advant Mod 300 Advabuild

Windows

References · 5

• https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200044199.882581162.1721753430-284724496.1718609177 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11639 · Security Note
• https://t.me/cvenotify/87152 · Telegram Post
• https://t.me/cvedetector/1524 · Telegram Post