Summary
ABB became aware of multiple internally discovered vulnerabilities in the WebPro SNMP card PowerValue for the product versions listed as affected in the advisory.
Depending upon the vulnerability, an attacker with access to local network who successfully exploited this vulnerability could have
- Unauthorized access
- Insufficient Session Expiration leading to resource unavailability
- Uncontrolled Resource Consumption leading to DOS attack
ABB strongly advises customers to update the latest firmware of affected products.
Vulnerabilities 3
-
High 8.8
Authentication bypass by brute forcing Authentication Headers
Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
-
Medium 6.5
Improper implementation of Modbus protocol leading to DOS attack
Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
-
Medium 6.5
Idle session timeout is not configured for multiple open ports
Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
Revision history
-
#1
Initial version.
References
-
ABB CYBERSECURITY ADVISORY - PDF Version
https://search.abb.com/library/Download.aspx?DocumentID=2CRT000009&LanguageCode=en&DocumentPartId=&Action=Launch