Skip to content
OpenAdvisories
High 2CRT000006 3 CVEs

ANC – ABB Network Card Multiple vulnerabilities in ANC

Published Apr 30, 2025 · Updated Apr 30, 2025 · Revision 2

Vendor: ABB Product: ANC Product: ANC-L

Summary

An update is available that resolves internally discovered vulnerabilities in the product versions listed as affected in the advisory.
Depending upon the vulnerability, an attacker with the access to the local network who successfully exploited this vulnerability could escalate the privilege to device admin and take control of the product.

Vulnerabilities 3

  • High 7.3
    CVE-2024-9876

    Application is vulnerable to Privilege escalation

    : Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4.

    ABB ANC-mini ANC-L ANC ICS / OT
  • Medium 4.3
    CVE-2024-9877

    Sensitive information submitted using GET method

    : Use of GET Request Method With Sensitive Query Strings vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4.

    ABB ANC ANC-mini ANC-L ICS / OT
  • Low 2.6
    CVE-2024-47784

    Unverified Password Change

    Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI This issue affects ANC software version 1.1.4 and earlier.

    ABB ANC ANC-mini ANC-L ICS / OT

Revision history

  1. #2

    Added NVD link to all vulnerabilities

  2. #1

    Initial version.

References