ICSA-20-154-03: ABB Multiple System 800xA Products
The vulnerability is caused by weak access control settings for objects used to exchange information between System 800xA processes on the same machine. An attacker could exploit this vulnerability by injecting garbage data or specially crafted data. An attacker who successfully exploits this vulnerability would be able to affect the online view of runtime data shown in Control Builder.CVE-2020-8478 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability is caused by weak access control settings for objects used to exchange information between System 800xA processes on the same machine. An attacker could exploit this vulnerability by injecting garbage data or specially crafted data. An attacker who successfully exploits this vulnerability would be able to manipulate the data to allow reads and writes to the controllers or cause the 800xA for DCI processes to crash.CVE-2020-8484 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability is caused by weak access control settings for objects used to exchange information between System 800xA processes on the same machine. An attacker could exploit this vulnerability by injecting garbage data or specially crafted data. An attacker who successfully exploits this vulnerability would be able to manipulate the data to allow reads and writes to the controllers or cause the 800xA for MOD 300 processes to crash.CVE-2020-8485 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability is caused by weak access control settings for objects used to exchange information between System 800xA processes on the same machine. An attacker could exploit this vulnerability by injecting garbage data or specially crafted data. An attacker who successfully exploits this vulnerability concerning 800xA RNRP would be able to affect node redundancy handling. The attacked node could perceive other nodes to be unavailable, which will disrupt the communication. When running the system in simulation mode, the simulated clock could be affected.CVE-2020-8486 has been assigned to this vulnerability. A CVSS v3 base score of 6.6 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H). The vulnerability is caused by weak access control settings for objects used to exchange information between System 800xA processes on the same machine. An attacker could exploit this vulnerability by injecting garbage data or specially crafted data. An attacker who successfully exploits this vulnerability concerning System 800xA Base would be able to affect node redundancy handling. The attacked node could perceive other nodes to be unavailable, which will disrupt the communication. When running the system in simulation mode, the simulated clock could be affected.CVE-2020-8487 has been assigned to this vulnerability. A CVSS v3 base score of 6.6 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H). The vulnerability is caused by weak access control settings for objects used to exchange information between System 800xA processes on the same machine. An attacker could exploit this vulnerability by injecting garbage data or specially crafted data. An attacker who successfully exploits this vulnerability would be able to affect how the UI is updated during batch execution. The compare and printing functionality in batch could also be affected.CVE-2020-8488 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability is caused by weak access control settings for objects used to exchange information between System 800xA processes on the same machine. An attacker could exploit this vulnerability by injecting garbage data or specially crafted data. An attacker who successfully exploits this vulnerability would be able to affect the runtime values that are to be stored in the archive. Also, this can make information management history services unavailable to the clients.CVE-2020-8489 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS v3.0: 7.8