ABB PB610 HMIStudio crashes after launching an empty *.JPR application file
CVE-2019-18994

3.9LOW

Key Information:

Vendor

Abb

Status
Abb Pb610 Panel Builder 600
Vendor
CVE Published:
18 December 2019

What is CVE-2019-18994?

Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty *.JPR application file. An attacker with access to the file system might be able to cause application malfunction such as denial of service.

Affected Version(s)

ABB PB610 Panel Builder 600 <= 2.8.0.424

References

http://search.abb.com/library/Download.aspx?DocumentID=3A...
x_refsource_MISC

CVSS V3.1

Score:
3.9
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NSFOCUS for providing vulnerability details and proof of concept.
.
CVE-2019-18994 : ABB PB610 HMIStudio crashes after launching an empty *.JPR application file