ABB PB610 HMISimulator does not check content-length of the HTTP request
CVE-2019-18995

4.3MEDIUM

Key Information:

Vendor

Abb

Status
Pb610 Panel Builder 600
Vendor
CVE Published:
18 December 2019

What is CVE-2019-18995?

The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing HMISimulator to denial of service via crafted HTTP requests manipulating the content-length setting.

Affected Version(s)

PB610 Panel Builder 600 <= 2.8.0.424

References

http://search.abb.com/library/Download.aspx?DocumentID=3A...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NSFOCUS for providing vulnerability details and proof of concept.
.
CVE-2019-18995 : ABB PB610 HMISimulator does not check content-length of the HTTP request