CVE-2023-3324
Assigner: ABB
Published: 2023-07-24T17:20:49.522Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: ABB Ability™ zenon
vendor: ABB
versions: lessThanOrEqual: 11 build 106404
status: affected
version: 11 build
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: ABB thanks Noam Moshe of Claroty Research - Team82, for helping to identify the vulnerabilities and protecting our customers.
datePublic: 2023-07-23T18:30:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted
programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts.<br><p>This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.</p>


value: 
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted
programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts.
This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.




metrics: cvssV3_1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-502
description: CWE-502 Deserialization of Untrusted Data
type: CWE
source: discovery: UNKNOWN
title:  Insecure deserialization in zenon internal DLLs
workarounds: supportingMedia: base64: no
type: text/html
value: 

The BinaryFormatter class used in implementation of zenon runtime is considered unsafe, as it allows users to create arbitrary classes not limited to the classes the developer intended to deserialize. By deserializing user-controlled content, it may be possible
for attackers may potentially load and run random code.&nbsp; The mitigation steps are as follows:
▪ In the Engineering Studio application remove the .cdwpf files from the graphics
folder of each project that contains .cdwpf files created by the 3D Configurator
tool.
▪ On the system with the Engineering Studio, for each affected project, remove
the RT folder containing the Service Engine files
▪ Compile new files in the Engineering Studio for each affected project
▪ On the system with the Service Engine, remove the RT folder of each affected
project
▪ Transport to or place onto the system with the Service Engine the newly created Service Engine files that no longer contain the .cdwpf files
• Note: the vulnerability only exists if the 3D configurator tool is used to generate .cdwpf files
that are used in screens in projects for display of 3D models

<br>
value: 
The BinaryFormatter class used in implementation of zenon runtime is considered unsafe, as it allows users to create arbitrary classes not limited to the classes the developer intended to deserialize. By deserializing user-controlled content, it may be possible
for attackers may potentially load and run random code.  The mitigation steps are as follows:
▪ In the Engineering Studio application remove the .cdwpf files from the graphics
folder of each project that contains .cdwpf files created by the 3D Configurator
tool.
▪ On the system with the Engineering Studio, for each affected project, remove
the RT folder containing the Service Engine files
▪ Compile new files in the Engineering Studio for each affected project
▪ On the system with the Service Engine, remove the RT folder of each affected
project
▪ Transport to or place onto the system with the Service Engine the newly created Service Engine files that no longer contain the .cdwpf files
• Note: the vulnerability only exists if the 3D configurator tool is used to generate .cdwpf files
that are used in screens in projects for display of 3D models



x_generator: engine: Vulnogram 0.1.0-dev