ABB Advant MOD 300 AdvaBuild up to 3.7 SP2 message integrity

Summaryinfo

A vulnerability was found in ABB Advant MOD 300 AdvaBuild up to 3.7 SP2 and classified as critical. Affected is an unknown function. The manipulation results in message integrity. This vulnerability is cataloged as CVE-2020-11639. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in ABB Advant MOD 300 AdvaBuild up to 3.7 SP2. Affected is an unknown code. The manipulation with an unknown input leads to a message integrity vulnerability. CWE is classifying the issue as CWE-924. The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An attacker could exploit the vulnerability by injecting garbage data or specially crafted data. Depending on the data injected each process might be affected differently. The process could crash or cause communication issues on the affected node, effectively causing a denial-of-service attack. The attacker could tamper with the data transmitted, causing the product to store wrong information or act on wrong data or display wrong information. This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2. For an attack to be successful, the attacker must have local access to a node in the system and be able to start a specially crafted application that disrupts the communication. An attacker who successfully exploited the vulnerability would be able to manipulate the data in such way as allowing reads and writes to the controllers or cause Windows processes in 800xA for MOD 300 and AdvaBuild to crash.

The advisory is shared for download at search.abb.com. This vulnerability is traded as CVE-2020-11639 since 04/08/2020. The exploitability is told to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/24/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• ABB

Name

• Advant MOD 300 AdvaBuild

Version

• 3.7 SP2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion