Abb
Page 2 of 3 — Abb CVEs from a corpus of 234, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-48845 | Critical | 9.4 | 2024-12-05 | Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/appli… |
CVE-2024-48844 | High | 7.7 | 2024-12-05 | Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; N… |
CVE-2024-48843 | High | 7.7 | 2024-12-05 | Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; N… |
CVE-2024-48840 | Critical | 10.0 | 2024-12-05 | Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series… |
CVE-2024-48839 | Critical | 10.0 | 2024-12-05 | Improper Input Validation vulnerability allows Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX S… |
CVE-2024-11317 | Critical | 10.0 | 2024-12-05 | Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. … |
CVE-2024-11316 | High | 7.5 | 2024-12-05 | Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - Enterprise v3.08.02… |
CVE-2024-8036 | Medium | 5.9 | 2024-10-25 | ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a… |
CVE-2024-6157 | Medium | 5.1 | 2024-10-10 | An attacker who successfully exploited these vulnerabilities could cause the robot to stop. A vulnerability exists in the PROFINET stack included in the Rob… |
CVE-2020-11640 | High | 8.8 | 2024-07-23 | AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the command queue can use it to launch an attack by running any ex… |
CVE-2020-11639 | High | 7.8 | 2024-07-23 | An attacker could exploit the vulnerability by injecting garbage data or specially crafted data. Depending on the data injected each process might be affected… |
CVE-2024-5402 | High | 7.8 | 2024-07-15 | Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated priv… |
CVE-2024-6298 | Critical | 10.0 | 2024-07-05 | Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arb… |
CVE-2024-6209 | Critical | 10.0 | 2024-07-05 | Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access file… |
CVE-2024-4007 | High | 8.8 | 2024-07-01 | Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured. |
CVE-2024-3036 | Medium | 5.7 | 2024-06-21 | Improper Input Validation vulnerability in ABB 800xA Base. An attacker who successfully exploited this vulnerability could cause services to crash by sending… |
CVE-2024-4009 | Critical | 9.2 | 2024-06-05 | Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-Syst… |
CVE-2024-4008 | Critical | 9.6 | 2024-06-05 | FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control via access to local KNX Bus-System |
CVE-2024-1914 | Medium | 6.5 | 2024-05-14 | An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible. The vulnerability could… |
CVE-2024-1913 | High | 7.6 | 2024-05-14 | An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible, or execute arbitrary code… |
CVE-2024-0335 | High | 7.5 | 2024-04-03 | ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products (e.g… |
CVE-2023-0426 | High | 8.6 | 2023-08-07 | ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product version… |
CVE-2023-0425 | High | 8.6 | 2023-08-07 | ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product version… |
CVE-2023-2685 | High | 7.2 | 2023-07-28 | A vulnerability was found in AO-OPC server versions mentioned above. As the directory information for the service entry is not enclosed in quotation marks, pot… |
CVE-2023-3324 | Medium | 6.3 | 2023-07-24 | A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-3323 | Medium | 5.9 | 2023-07-24 | A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-3322 | High | 7.0 | 2023-07-24 | A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-3321 | High | 7.0 | 2023-07-24 | A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-2625 | Critical | 9.0 | 2023-06-28 | A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of acc… |
CVE-2023-2876 | Low | 3.1 | 2023-06-13 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware mod… |
CVE-2023-0636 | High | 7.2 | 2023-06-05 | Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103… |
CVE-2023-0635 | High | 7.8 | 2023-06-05 | Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQ… |
CVE-2022-0010 | High | 7.8 | 2023-05-22 | Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has… |
CVE-2023-0864 | High | 7.1 | 2023-05-17 | Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terr… |
CVE-2023-0863 | High | 8.8 | 2023-05-17 | Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC… |
CVE-2023-0580 | Medium | 5.4 | 2023-04-06 | Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability… |
CVE-2022-3192 | Medium | 5.3 | 2023-03-31 | Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6. |
CVE-2023-1258 | Medium | 5.3 | 2023-03-31 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footpr… |
CVE-2022-4126 | Critical | 9.6 | 2023-03-27 | Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: befo… |
CVE-2022-26080 | Medium | 6.3 | 2023-03-16 | Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus Syst… |
CVE-2023-0228 | High | 8.8 | 2023-03-02 | Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3… |
CVE-2021-22283 | Medium | 6.2 | 2023-02-28 | Improper Initialization vulnerability in ABB Relion protection relays - 611 series, ABB Relion protection relays - 615 series IEC 4.0 FP1, ABB Relion protectio… |
CVE-2022-1607 | Medium | 4.6 | 2023-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.Thi… |
CVE-2022-3573 | Medium | 5.4 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-34838 | High | 8.1 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data p… |
CVE-2022-34837 | Medium | 6.2 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network cl… |
CVE-2022-34836 | Medium | 5.9 | 2022-08-24 | Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., fl… |
CVE-2022-0902 | High | 8.1 | 2022-07-21 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injecti… |
CVE-2022-1596 | Medium | 6.5 | 2022-06-21 | Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an… |
CVE-2022-31219 | High | 7.3 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31218 | High | 7.8 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31217 | High | 7.8 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-31216 | High | 7.8 | 2022-06-15 | Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-26057 | Medium | 6.7 | 2022-06-15 | Vulnerabilities in the Mint WorkBench allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary conten… |
CVE-2022-29483 | High | 7.8 | 2022-06-02 | Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confident… |
CVE-2022-28702 | Medium | 6.1 | 2022-06-02 | Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with SYSTEM permissions violating confident… |
CVE-2022-0947 | Critical | 9.0 | 2022-05-10 | A vulnerability in ABB ARG600 Wireless Gateway series that could allow an attacker to exploit the vulnerability by remotely connecting to the serial port gatew… |
CVE-2022-28613 | High | 7.5 | 2022-05-02 | A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and configured, an attac… |
CVE-2021-22277 | High | 7.5 | 2022-04-01 | Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control and I/O, ABB Base Sof… |
CVE-2021-22288 | High | 7.5 | 2022-02-04 | Improper Input Validation vulnerability in the ABB SPIET800 and PNI800 module allows an attacker to cause the denial of service or make the module unresponsive. |
CVE-2021-22286 | High | 7.5 | 2022-02-04 | Improper Input Validation vulnerability in the ABB SPIET800 and PNI800 module allows an attacker to cause the denial of service or make the module unresponsive. |
CVE-2021-22285 | High | 7.5 | 2022-02-04 | Improper Handling of Exceptional Conditions, Improper Check for Unusual or Exceptional Conditions vulnerability in the ABB SPIET800 and PNI800 module that allo… |
CVE-2021-22284 | High | 8.4 | 2022-02-04 | Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running… |
CVE-2021-22279 | Critical | 9.8 | 2021-12-13 | A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if th… |
CVE-2021-22278 | Medium | 6.7 | 2021-10-28 | A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on computer which has PCM600… |
CVE-2021-22272 | Medium | 6.5 | 2021-09-27 | The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device… |
CVE-2021-22276 | Medium | 6.1 | 2021-09-23 | The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point. |
CVE-2020-24672 | Critical | 9.8 | 2021-09-08 | A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue aff… |
CVE-2020-24686 | High | 7.5 | 2021-02-26 | The vulnerabilities can be exploited to cause the web visualization component of the PLC to stop and not respond, leading to genuine users losing remote visibi… |
CVE-2020-24685 | High | 8.6 | 2021-02-09 | An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attac… |
CVE-2020-24683 | Critical | 9.8 | 2020-12-22 | The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (cl… |
CVE-2020-24680 | High | 7.0 | 2020-12-22 | In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database. |
CVE-2020-24679 | High | 7.5 | 2020-12-22 | A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbi… |
CVE-2020-24678 | High | 8.8 | 2020-12-22 | An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by… |
CVE-2020-24677 | High | 8.8 | 2020-12-22 | Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewh… |
CVE-2020-24676 | High | 7.8 | 2020-12-22 | In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (but authenticated) u… |
CVE-2020-24675 | Critical | 9.8 | 2020-12-22 | In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History ser… |
CVE-2020-24674 | High | 8.8 | 2020-12-22 | In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execu… |
CVE-2020-24673 | Critical | 9.8 | 2020-12-22 | In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), e… |
CVE-2020-10288 | Critical | 9.8 | 2020-07-15 | IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever… |
CVE-2020-10287 | Critical | 9.8 | 2020-07-15 | The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documente… |
CVE-2020-8482 | High | 7.8 | 2020-05-29 | Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read fi… |
CVE-2019-5620 | Critical | 9.8 | 2020-04-29 | ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function. |
CVE-2020-8489 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management (all published versions) enables an attacker au… |
CVE-2020-8488 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management (all published versions) enables an attacker authenti… |
CVE-2020-8487 | Medium | 6.6 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA Base (all published versions) enables an attacker authenticated on the… |
CVE-2020-8486 | Medium | 6.6 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP (all published versions) enables an attacker authenticated on the… |
CVE-2020-8485 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 (all published versions) enables an attacker authenticated… |
CVE-2020-8484 | High | 7.8 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI (all published versions) enables an attacker authenticated on… |
CVE-2020-8481 | Critical | 9.8 | 2020-04-29 | For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0… |
CVE-2020-8479 | Critical | 9.4 | 2020-04-29 | For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI… |
CVE-2020-8478 | Medium | 5.3 | 2020-04-29 | Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Softw… |
CVE-2020-8476 | Medium | 5.3 | 2020-04-29 | For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI… |
CVE-2020-8475 | Medium | 5.3 | 2020-04-29 | For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI… |
CVE-2020-8471 | High | 7.8 | 2020-04-29 | For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI… |
CVE-2020-8473 | High | 7.3 | 2020-04-29 | Insufficient folder permissions used by system functions in ABB System 800xA Base (version 6.1 and earlier) allow low privileged users to read, modify, add and… |
CVE-2020-8472 | Medium | 5.5 | 2020-04-29 | Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Pro… |
CVE-2020-11420 | Medium | 6.5 | 2020-04-27 | UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerability by manipulating… |
CVE-2020-8477 | High | 8.8 | 2020-04-22 | The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to… |
CVE-2020-8474 | High | 7.8 | 2020-04-22 | Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system functionality, all… |