CVE-2020-24676: Insecure Windows Services in Symphony Plus
First published: Tue Dec 22 2020(Updated: )
In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (but authenticated) user could execute arbitrary code and result in privilege escalation, depending on the user that the service runs as.
Credit: cybersecurity@ch.abb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ABB Symphony + Historian | =3.0 | |
| ABB Symphony + Historian | =3.1 | |
| ABB Symphony Plus Operations | =1.1 | |
| ABB Symphony Plus Operations | =2.0 | |
| ABB Symphony Plus Operations | =2.1-sp1 | |
| ABB Symphony Plus Operations | =2.1-sp2 | |
| ABB Symphony Plus Operations | =3.0 | |
| ABB Symphony Plus Operations | =3.1 | |
| ABB Symphony Plus Operations | =3.2 | |
| ABB Symphony Plus Operations | =3.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-24676?
CVE-2020-24676 has a medium severity level due to its potential for privilege escalation.
How do I fix CVE-2020-24676?
To remediate CVE-2020-24676, update the affected versions of Symphony Plus Operations and Symphony Plus Historian to the latest patched versions.
What versions are affected by CVE-2020-24676?
CVE-2020-24676 affects Symphony Plus Operations versions 1.1, 2.0, 2.1 (SP1 and SP2), 3.0, 3.1, 3.2, and 3.3, as well as Symphony Plus Historian versions 3.0 and 3.1.
Who is affected by CVE-2020-24676?
Any organization using the specified versions of Symphony Plus Operations and Symphony Plus Historian is at risk of exploitation due to CVE-2020-24676.
What type of attack does CVE-2020-24676 facilitate?
CVE-2020-24676 enables unprivileged but authenticated users to execute arbitrary code, leading to privilege escalation.
- agent/references
- agent/type
- agent/softwarecombine
- agent/title
- agent/severity
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/abb
- canonical/abb symphony + historian
- version/abb symphony + historian/3.0
- version/abb symphony + historian/3.1
- canonical/abb symphony plus operations
- version/abb symphony plus operations/1.1
- version/abb symphony plus operations/2.0
- version/abb symphony plus operations/2.1-sp1
- version/abb symphony plus operations/2.1-sp2
- version/abb symphony plus operations/3.0
- version/abb symphony plus operations/3.1
- version/abb symphony plus operations/3.2
- version/abb symphony plus operations/3.3