Detections
Analytics

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8484)

high Tenable OT Security Plugin ID 500927

Synopsis

The remote OT asset is affected by a vulnerability.

Description

Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI (all published versions) enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

ABB recommends changing any user account passwords suspected to be known by an unauthorized person. ABB recommends users disable interactive logon (both local and remote) for the service account.

Please note these vulnerabilities can only be exploited by authenticated users. ABB recommendeds users ensure only authorized persons have access to user accounts in System 800xA.

ABB plans to correct these vulnerabilities in future product versions.

For more information, please refer to ABB’s Cybersecurity Advisory.

See Also

http://www.nessus.org/u?02af1286

https://www.cisa.gov/news-events/ics-advisories/icsa-20-154-03

Plugin Details

Severity: High

ID: 500927

Version: 1.5

Type: remote

Family: Tenable.ot

Published: 3/29/2023

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-8484

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:abb:800xa:::~~~~dci~

Required KB Items: Tenable.ot/ABB

Exploit Ease: No known exploits are available

Patch Publication Date: 4/29/2020

Vulnerability Publication Date: 4/29/2020

Reference Information

CVE: CVE-2020-8484

ICSA: 20-154-03