CVE-2020-24675: Weak Authentication in Symphony Plus

Published Dec 22, 2020

Updated

In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History server) and ultimately write values to the controlled process.

Affected Software

10 affected components

ABB Symphony \+ Historian=3.0

ABB Symphony \+ Historian=3.1

ABB Symphony \+ Operations=1.1

ABB Symphony \+ Operations=2.0

ABB Symphony \+ Operations=2.1-sp1

ABB Symphony \+ Operations=2.1-sp2

ABB Symphony \+ Operations=3.0

ABB Symphony \+ Operations=3.1

ABB Symphony \+ Operations=3.2

ABB Symphony \+ Operations=3.3

Event History

Dec 22, 2020

CVE Published

via MITRE·09:22 PM

Data Sourced

via MITRE·09:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-24675?

CVE-2020-24675 is a vulnerability in ABB Symphony + Historian and Symphony + Operations that allows an unauthenticated user to inject values into the Operations History server or standalone S+ History server and write values to the controlled process.

Which software versions are affected by CVE-2020-24675?

The affected software versions are Symphony + Historian 3.0 and 3.1, and Symphony + Operations 1.1, 2.0, 2.1-sp1, 2.1-sp2, 3.0, 3.1, 3.2, and 3.3.

What is the severity of CVE-2020-24675?

CVE-2020-24675 has a severity score of 9.8 (Critical).

How can an unauthenticated user exploit CVE-2020-24675?

An unauthenticated user can exploit CVE-2020-24675 by injecting values into the Operations History server or standalone S+ History server and writing values to the controlled process.

How can I mitigate CVE-2020-24675?

To mitigate CVE-2020-24675, update to the latest version of Symphony + Historian or Symphony + Operations as recommended by ABB and follow the guidelines provided in the security advisory.