by Kastro
Paper/Archive/CVE-2020-24679

CVE-2020-24679

ABB ABB Ability™ Symphony® Plus Operations — Denial of Service attack on Symphony Plus

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 79.5.795 × 2015.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted.

Affected

ProductAffectedFixed inSource
ABB Ability™ Symphony® Plus Operationsunspecified – < 3.3 Service Pack 13.3 Service Pack 1CNA
ABB Ability™ Symphony® Plus Operationsunspecified – < 2.1 SP2 Rollup 22.1 SP2 Rollup 2CNA
ABB Ability™ Symphony® Plus Operationsunspecified – < 2.22.2CNA
ABB Ability™ Symphony® Plus Historianunspecified – < 3.23.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ABB (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

refsearch.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launchrefsearch.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch