CVE-2019-7227: Path Traversal
In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the FTP server functionality to download and upload files. An unauthenticated attacker can take advantage of the hardcoded or default credential pair exor/exor to become an authenticated attacker.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7227?
CVE-2019-7227 is classified as a high severity vulnerability due to its potential for authenticated directory traversal and unauthorized file access.
How do I fix CVE-2019-7227?
To remediate CVE-2019-7227, change the default credentials used for the ABB IDAL FTP server and ensure proper access controls are in place.
Who is affected by CVE-2019-7227?
CVE-2019-7227 affects users of ABB PB610 Panel Builder 600 firmware versions from 1.91 to 2.8.0.367.
Can CVE-2019-7227 be exploited by unauthenticated attackers?
Yes, CVE-2019-7227 can be exploited by unauthenticated attackers if default or hardcoded credentials are not changed.
What types of attacks are possible with CVE-2019-7227?
CVE-2019-7227 can lead to directory traversal attacks allowing attackers to upload and download arbitrary files.