ABB System 800xA Information Manager Remote Code Execution
CVE-2020-8477

8.8HIGH

Key Information:

Vendor

Abb

Status
System 800xa Information Manager
Vendor
CVE Published:
22 April 2020

What is CVE-2020-8477?

The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code.

Affected Version(s)

System 800xA Information Manager 5 <= 5.1

System 800xA Information Manager 6.0 <= 6.0.3.2

System 800xA Information Manager 6.1 < 6.1*

References

https://search.abb.com/library/Download.aspx?DocumentID=2...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.