Vulnerability in Abb Board Support Package Un31
CVE-2019-7229
The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of encryption or authenticity checks against the new firmware HMI software binary files.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.011 (64.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 64.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
Weakness classification (CWE)
References
- seclists.org/fulldisclosure/2019/Jun/34 (mailing-list, Exploit, Mailing List, Third Party Advisory)
- www.darkmatter.ae/xen1thlabs/abb-hmi-absence-of-signature-verification-vulnerab… (Exploit, Third Party Advisory)
- search.abb.com/library/Download.aspx (Patch, Mitigation, Vendor Advisory)
- search.abb.com/library/Download.aspx (Patch, Mitigation, Vendor Advisory)
- packetstormsecurity.com/files/153387/ABB-HMI-Missing-Signature-Verification.html (Exploit, VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-7229?
- CVE-2019-7229 is a high-severity vulnerability in Abb Board Support Package Un31, classified under Download of Code Without Integrity Check. CVSS score: 8.3/10. Published 2019-06-24.
- How severe is CVE-2019-7229?
- High severity. CVSS v3 base score is 8.3 out of 10.