Critical ICSA-20-154-04 5 CVEs

ABB Central Licensing System

Published Jun 2, 2020 · Updated Jun 2, 2020

Vendor: ABB Product: Ability Knowledge Manager Product: Ability Manufacturing Operations Management Product: Ability Symphony Plus - S+ Engineering Product: Ability Symphony Plus - S+ Operations Product: Ability System 800xA / Advant OCS Control Builder A Product: Ability System 800xA and related system extensions Product: AdvaBuild Product: Advant OCS AC 100 OPC Server Product: Compact HMI Product: Composer CTK Product: Composer Harmony Product: Composer Melody (incl. SPE for Melody 1.0 SPx) Product: Control Builder Safe Product: Harmony OPC Server (HAOPC) Product: OPC Data Link Product: OPC Server MOD 300 (non-800xA)

Summary

Successful exploitation of these vulnerabilities could allow an attacker to take control of the affected system node remotely and cause an affected CLS Server node to stop or prevent legitimate access to the affected CLS Server.

Vulnerabilities 5

Critical 9.8

CVE-2020-8481

ABB Central Licensing System - Information disclosure

For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Comp…

ABB Symphony Plus S+ Operations Control Builder Safe Symphony Plus S+ Engineering ICS / OT

Apr 29, 2020
Critical 9.4

CVE-2020-8479

ABB Central Licensing System - XML External Entity Injection

For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2…

ABB Symphony Plus S+ Operations Control Builder Safe Symphony Plus S+ Engineering ICS / OT

Apr 29, 2020
High 7.8

CVE-2020-8471

ABB Central Licensing System - Weak File Permissions

For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2…

ABB Symphony Plus S+ Operations Control Builder Safe Symphony Plus S+ Engineering ICS / OT

Apr 29, 2020
Medium 5.3

CVE-2020-8475

ABB Central Licensing System - Denial of Service Vulnerability

For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2…

ABB Symphony Plus S+ Operations Control Builder Safe Symphony Plus S+ Engineering ICS / OT

Apr 29, 2020
Medium 5.3

CVE-2020-8476

ABB Central Licensing System - Elevation of Privilege Vulnerability

For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2…

ABB Symphony Plus S+ Operations Symphony Plus S+ Engineering Control Builder Safe ICS / OT

Apr 29, 2020

Revision history

2020-06-02 #1
ICSA-20-154-04 ABB Central Licensing System

References

ICS Advisory ICSA-20-154-04 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-20-154-04
Recommended Practices
https://www.us-cert.gov/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B