// For flags

CVE-2020-8472

ABB System 800xA Weak File Permissions - different products

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications.

Los permisos de carpeta insuficientes usados por las funciones del sistema en los productos de ABB System 800xA, OPCServer para AC800M (versiones 6.0 y anteriores) y Control Builder M Professional, MMSServer para AC800M, Base Software para SoftControl (versiones 6.1 y anteriores), permiten a usuarios pocos privilegiados leer, modificar, añadir y eliminar archivos de sistema y de aplicaciones. Un atacante autenticado que explote con éxito las vulnerabilidades podría escalar sus privilegios, causar que las funcionalidades del sistema se detengan y corromper las aplicaciones de los usuarios.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-30 CVE Reserved
  • 2020-04-28 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Abb
Search vendor "Abb"
 Control Builder M
Search vendor "Abb" for product "Control Builder M"
 <= 6.1
Search vendor "Abb" for product "Control Builder M" and version " <= 6.1"
professional
Affected
in Abb
Search vendor "Abb"
 Ac800m
Search vendor "Abb" for product "Ac800m"
--
Safe
Abb
Search vendor "Abb"
 Mms Server
Search vendor "Abb" for product "Mms Server"
 <= 6.1
Search vendor "Abb" for product "Mms Server" and version " <= 6.1"
-
Affected
in Abb
Search vendor "Abb"
 Ac800m
Search vendor "Abb" for product "Ac800m"
--
Safe
Abb
Search vendor "Abb"
 Opc Server
Search vendor "Abb" for product "Opc Server"
 <= 6.0
Search vendor "Abb" for product "Opc Server" and version " <= 6.0"
-
Affected
in Abb
Search vendor "Abb"
 Ac800m
Search vendor "Abb" for product "Ac800m"
--
Safe
Abb
Search vendor "Abb"
 Base Software
Search vendor "Abb" for product "Base Software"
 <= 6.1
Search vendor "Abb" for product "Base Software" and version " <= 6.1"
softcontrol
Affected