Lucene search

ABBCVE-2020-24685

HistoryFeb 09, 2021 - 4:15 a.m.

CVE-2020-24685

2021-02-0904:15:14

CWE-770

CWE-789

ABB

web.nvd.nist.gov

cve-2020-24685

dos vulnerability

abb ac500 v2

plc

network security

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

42.5%

JSON

An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attacker to stop the PLC. After stopping (ERR LED flashing red), physical access to the PLC is required in order to restart the application. This issue affects: ABB AC500 V2 products with onboard Ethernet version 2.8.4 and prior versions.

Affected configurations

Nvd

Node

abbpm573-ethMatch2.0

abbpm583-ethMatch2.0

AND

abbac500_cpu_firmwareRange<2.8.5

VendorProductVersionCPE
abbpm573-eth2.0cpe:2.3:h:abb:pm573-eth:2.0:*:*:*:*:*:*:*
abbpm583-eth2.0cpe:2.3:h:abb:pm583-eth:2.0:*:*:*:*:*:*:*
abbac500_cpu_firmware*cpe:2.3:o:abb:ac500_cpu_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
abb	pm573-eth	2.0	cpe:2.3:h:abb:pm573-eth:2.0:::::::*
abb	pm583-eth	2.0	cpe:2.3:h:abb:pm583-eth:2.0:::::::*
abb	ac500_cpu_firmware	*	cpe:2.3:o:abb:ac500_cpu_firmware::::::::

CNA Affected

[
  {
    "product": "AC500 V2 products with onboard Ethernet",
    "vendor": "ABB",
    "versions": [
      {
        "status": "affected",
        "version": "version 2.8.4 and prior versions"
      }
    ]
  }
]

References

search.abb.com/library/Download.aspx?DocumentID=3ADR010667&LanguageCode=en&DocumentPartId=&Action=Launch

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

42.5%

JSON

Related for CVE-2020-24685