Summary
ABB became aware of an internally discovered vulnerability in the MConfig product versions listed as affected in the advisory.
An attacker with access to local networks who successfully exploits vulnerability could have access to application’s sensitive information.
ABB strongly advises customers to update MConfig with latest software version.
Vulnerabilities 1
-
High 7.4
Application credential stored in clear text in memory
Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21.
Revision history
-
#2
Initial CISA Republication of ABB PSIRT 4TZ00000006008 advisory
-
#1
Initial version.
References
-
ABB CYBERSECURITY ADVISORY - PDF version.
https://search.abb.com/library/Download.aspx?DocumentID=4TZ00000006008&LanguageCode=en&DocumentPartId=&Action=Launch
-
ICS Advisory ICSA-26-146-06 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-146-06
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b