RVD#3327: No authentication required for accesing ABB IRC5 FTP server
CVE-2020-10288

9.8CRITICAL

Key Information:

Vendor
Abb
Status
Irb140
Vendor
CVE Published:
15 July 2020

Summary

IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted.

Affected Version(s)

IRB140 = unspecified

References

https://github.com/aliasrobotics/RVD/issues/3327
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alfonso Glera, Victor Mayoral Vilches (Alias Robotics)
.