by Kastro
Paper/Archive/CVE-2023-5778

CVE-2023-5778

ABB Freelance Controller DCP — Missing Length Check

EPSS 0.5%CVSS 9.2
critical.is priorityof 100
36
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 39.9.399 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900. This issue affects Freelance Controller DCP: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC700: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC800: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1; Freelance Controller AC900: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 2019 SP1.

Affected

ProductAffectedFixed inSource
Freelance Controller DCP≤ 20132019 SP1 FP1CNA
Freelance Controller DCP2013 SP1–CNA
Freelance Controller DCP2016–CNA
Freelance Controller DCP2016 SP1–CNA
Freelance Controller DCP2019–CNA
Freelance Controller DCP2019 SP1–CNA
Freelance Controller AC700≤ 20132019 SP1 FP1CNA
Freelance Controller AC7002013 SP1–CNA
Freelance Controller AC7002016–CNA
Freelance Controller AC7002016 SP1–CNA
Freelance Controller AC7002019–CNA
Freelance Controller AC7002019 SP1–CNA

Scores by source

ABB (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:U/V:C/RE:H
ABB (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refsearch.abb.com/library/Download.aspx?DocumentID=7PAA010706&LanguageCode=en&DocumentPartId=&Action=Launch