CVE-2020-8475 Information

Description

For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1 6.0 and 6.1 Compact HMI versions 5.1 and 6.0 Control Builder Safe 1.0 1.1 and 2.0 Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2 Composer Harmony 5.1 6.0 and 6.1 Melody Composer 5.3 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3) Harmony OPC Server (HAOPC) Standalone 6.0 6.1 and 7.0 ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4 Advant® OCS AC100 OPC Server 5.1 6.0 and 6.1 Composer CTK 6.1 and 6.2 AdvaBuild 3.7 SP1 and SP2 OPCServer for MOD 300 (non-800xA) 1.4 OPC Data Link 2.1 and 2.2 Knowledge Manager 8.0 9.0 and 9.1 Manufacturing Operations Management 1812 and 1909 a weakness in validation of input exists that allows an attacker to block license handling by sending specially crafted messages to the CLS web service.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reference

https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch https://www.us-cert.gov/ics/advisories/icsa-20-154-04

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.5