Summary
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory.
An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a write operation to the flash memory to alter the firmware behavior.
Vulnerabilities 3
-
Medium 6.1
Heap Memory Corruption Vulnerability
Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
-
Medium 6.1
BSS(Block Started by Symbol) Memory Corruption Vulnerability
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
-
Medium 6.1
Stack Memory Corruption Vulnerability
Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
Revision history
-
#8
Initial CISA Republication of ABB PSIRT 9AKK108471A8107 advisory
-
#7
Fixed Version update
-
#6
CVE update
-
#5
CVE update
-
#4
CVSS update
-
#3
Minor corrections
-
#2
DocumentID update
-
#1
Initial version.
References
-
ABB CYBERSECURITY ADVISORY - PDF Version
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A8107&LanguageCode=en&DocumentPartId=&Action=Launch
-
ABB E-mobility, " Release notes Terra AC FW v1.8.34 JPN External," [Online]. Available:
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A7976&LanguageCode=en&DocumentPartId=&Action=Launch.
-
ABB E-mobility, " BCM.V3Y01.0-JP Terra AC Installation Manual V006" [Online]. Available:
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A9488&LanguageCode=en&LanguageCode=ja&DocumentPartId=&Action=Launch.
-
ICS Advisory ICSA-26-141-05 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-05
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b