CVE-2019-7226: High severity abb pb610 panel builder 600 firmware vulnerability
The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. Specifically, /cgi/loginDefaultUser creates a session in an authenticated state and returns the session ID along with what may be the username and cleartext password of the user. An attacker can then supply an IDALToken value in a cookie, which will allow them to perform privileged operations such as restarting the service with /cgi/restart. A GET request to /cgi/loginDefaultUser may result in "1 #SOK IDALToken=532c8632b86694f0232a68a0897a145c admin admin" or a similar response.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7226?
CVE-2019-7226 is considered to be of high severity due to its potential for unauthorized access to privileged functions.
How do I fix CVE-2019-7226?
To fix CVE-2019-7226, update the ABB PB610 Panel Builder 600 firmware to a version later than 2.8.0.367.
Who is affected by CVE-2019-7226?
Users of the ABB PB610 Panel Builder 600 firmware versions between 1.91 and 2.8.0.367 are affected by CVE-2019-7226.
What does CVE-2019-7226 exploit?
CVE-2019-7226 exploits a vulnerability in the ABB IDAL HTTP server's CGI interface that allows authentication bypass.
Is authentication required to exploit CVE-2019-7226?
No, CVE-2019-7226 allows unauthenticated attackers to exploit the vulnerability.