Summary
ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is now available that addresses and remediates the vulnerability.
An attacker who successfully exploited this vulnerability could read sensitive information in the logging data of the PVI client application. Logging is deactivated by default in all PVI client versions.
Vulnerabilities 1
-
Medium 5.0
Insertion of Sensitive Information into Logfile
An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential information which is processed by the PVI client application. The logging function …
Revision history
-
#2
Corrected vendor name from 'ABB' to 'B&R Industrial Automation GmbH' to ensure accurate product matching.
-
#1
Initial version.
References
-
ABB CYBERSECURITY ADVISORY - PDF Version
https://www.br-automation.com/fileadmin/SA26P001-2862434c.pdf