Cross Site Scripting vulnerability in NE843 Pulsar Plus Controller
CVE-2022-1607

4.6MEDIUM

Key Information:

Vendor

Abb

Status
Pulsar Plus System Controller Ne843 S
Infinity Dc Power Plant
Vendor
CVE Published:
24 February 2023

What is CVE-2022-1607?

Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.

Affected Version(s)

Infinity DC Power Plant H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415

Pulsar Plus System Controller NE843_S comcode 150042936

References

https://search.abb.com/library/Download.aspx?DocumentID=9...

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

We acknowledge the help of Vlad Ionescu of Facebook Red Team X for reports on the vulnerabilities.
.