What is CVE-2020-24685?

CVE-2020-24685 is a high-severity vulnerability in Abb Ac500 CPU Firmware, classified under CWE-789. CVSS score: 8.6/10. Published 2021-02-09.

How severe is CVE-2020-24685?

High severity. CVSS v3 base score is 8.6 out of 10.

Is CVE-2020-24685 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Resource exhaustion in Abb Ac500 CPU Firmware

CVE-2020-24685

An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attacker to stop the PLC. After stopping (ERR LED flashing red), physical access to the PLC is required in order to restart the application. This issue affects: ABB AC500 V2 products with onboard Ethernet version 2.8.4 and prior versions.

EPSS: 0.016 (73.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.

Affected products

Abb Ac500_cpu_firmware
Abb Ac500 V2 Products With Onboard Ethernet — versions version 2.8.4 and prior versions
Abb Pm573-eth — versions 2.0
Abb Pm583-eth — versions 2.0

Weakness classification (CWE)

Public proof-of-concept exploits

yossireuven/Publications

References

cybersecurity@ch.abb.com (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2020-24685?: CVE-2020-24685 is a high-severity vulnerability in Abb Ac500 CPU Firmware, classified under CWE-789. CVSS score: 8.6/10. Published 2021-02-09.
How severe is CVE-2020-24685?: High severity. CVSS v3 base score is 8.6 out of 10.
Is CVE-2020-24685 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.