CVE-2020-24680: Improper Credential Storage in Symphony Plus

Published Dec 22, 2020

Updated

In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database.

Affected Software

10 affected components

ABB Symphony \+ Historian=3.0

ABB Symphony \+ Historian=3.1

ABB Symphony \+ Operations=1.1

ABB Symphony \+ Operations=2.0

ABB Symphony \+ Operations=2.1-sp1

ABB Symphony \+ Operations=2.1-sp2

ABB Symphony \+ Operations=3.0

ABB Symphony \+ Operations=3.1

ABB Symphony \+ Operations=3.2

ABB Symphony \+ Operations=3.3

Event History

Dec 22, 2020

CVE Published

via MITRE·09:18 PM

Data Sourced

via MITRE·09:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-24680?

CVE-2020-24680 is a vulnerability in ABB Symphony+ Operations and Symphony+ Historian where the passwords of internal users are improperly stored in a database.

What is the severity of CVE-2020-24680?

CVE-2020-24680 has a severity level of high.

Which software versions are affected by CVE-2020-24680?

CVE-2020-24680 affects ABB Symphony+ Historian versions 3.0 and 3.1, as well as ABB Symphony+ Operations versions 1.1, 2.0, 2.1-sp1, 2.1-sp2, 3.0, 3.1, 3.2, and 3.3.

How are the passwords of internal users stored in ABB Symphony+ Operations and Symphony+ Historian?

The passwords of internal users in ABB Symphony+ Operations and Symphony+ Historian are encrypted but improperly stored in a database.

Is there a fix available for CVE-2020-24680?

Yes, ABB has provided patches and specific hardening measures to address the vulnerability. Please refer to the provided references for more information.