ABB Central Licensing System Exposure of Sensitive Information to an Unauthorized Actor (CVE-2020-8481)

critical Tenable OT Security Plugin ID 500930

Synopsis

The remote OT asset is affected by a vulnerability.

Description

For ABB products ABB Ability System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability System 800xA/ Advant OCS Control Builder A 1.3 and 1.4, Advant OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

ABB recommends the following mitigations:

- Upgrade ABB CLS to the following versions:
- 5.1 Rev A (5.1.0.38)
- 5.1 Rev E (5.1.0.99)
- 6.0 (6.0.0.26)
- 6.0.3.3 (6.0.03000.192)
- 6.1 RU1 (6.1.00100.417)
- If ABB Central Licensing Server 5.1 (5.1.0.14) or earlier has been used on the currently used hardware, please contact ABB for further assistance.
- Vulnerabilities pertaining to CVE-2020-8475 and CVE-2020-8476 will be corrected in future product versions. Updates will be added to this advisory once they become available.
- Methods for preventing unauthorized access to nodes on the CLS network include but are not limited to usage of IPSec and by separating the Client Server Network from other networks with firewalls.
- Ensure only authorized individuals have access to user accounts on the system nodes.
- Interactive login to service accounts should be blocked.

For more information, please see ABB's cybersecurity advisory.

Plugin Details

Severity: Critical

ID: 500930

Version: 1.5

Type: remote

Family: Tenable.ot

Published: 3/29/2023

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-8481

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:abb:800xa_system:5.1:-

Required KB Items: Tenable.ot/ABB

Exploit Ease: No known exploits are available

Patch Publication Date: 4/29/2020

Vulnerability Publication Date: 4/29/2020

Reference Information

CVE: CVE-2020-8481

CWE: 922

ICSA: 20-154-04

Detections

Analytics