Summary
An update is available that resolves vulnerability in the product versions as affected in this advisory.
An attacker who successfully exploits the vulnerability could get unauthorized access to the file system
on the host machine. This can lead to the execution of arbitrary code, data leakage, or even complete
system compromise.
Vulnerabilities 1
-
Critical 9.1CVE-2024-48510 Public exploit
DotNetZip Directory Traversal vulnerability
Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maint…
Revision history
-
#1.0.0
Initial version
References
-
Technical Guide - Cybersecurity for ABB Drives (3AXD10000492137)
https://search.abb.com/library/Download.aspx?DocumentID=3AXD10000492137&LanguageCode=en&DocumentPartId=1&Action=Launch
-
ABB CYBERSECURITY ADVISORY - PDF version
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5466&LanguageCode=en&DocumentPartId=&Action=Launch
-
Directory Traversal vulnerability in DotNetZip
https://nvd.nist.gov/vuln/detail/CVE-2024-48510
-
ICS Advisory ICSA-25-037-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-037-03
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B