CVE-2020-24685: AC500 V2 unauthenticated crafter packet vulnerability
First published: Tue Feb 09 2021(Updated: )
An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attacker to stop the PLC. After stopping (ERR LED flashing red), physical access to the PLC is required in order to restart the application. This issue affects: ABB AC500 V2 products with onboard Ethernet version 2.8.4 and prior versions.
Credit: cybersecurity@ch.abb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Abb Ac500 Cpu Firmware | <2.8.5 | |
| Abb Pm573-eth | =2.0 | |
| Abb Pm583-eth | =2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-24685?
CVE-2020-24685 is a denial-of-service (DoS) vulnerability that can be triggered by an unauthenticated specially crafted packet sent by an attacker over the network.
What is the severity of CVE-2020-24685?
The severity of CVE-2020-24685 is high, with a severity value of 8.6.
How does CVE-2020-24685 affect ABB AC500 CPU firmware?
ABB AC500 CPU firmware versions up to and excluding 2.8.5 are affected by CVE-2020-24685.
How does CVE-2020-24685 affect ABB PM573-ETH?
ABB PM573-ETH version 2.0 is not vulnerable to CVE-2020-24685.
How does CVE-2020-24685 affect ABB PM583-ETH?
ABB PM583-ETH version 2.0 is not vulnerable to CVE-2020-24685.
How can I fix CVE-2020-24685?
To mitigate CVE-2020-24685, update the ABB AC500 CPU firmware to version 2.8.5 or later. Additional measures may be required depending on the specific environment.
Where can I find more information about CVE-2020-24685?
You can find more information about CVE-2020-24685 at the following reference link: [https://search.abb.com/library/Download.aspx?DocumentID=3ADR010667&LanguageCode=en&DocumentPartId=&Action=Launch]
What are the CWE IDs associated with CVE-2020-24685?
The CWE IDs associated with CVE-2020-24685 are CWE-770 and CWE-789.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/author
- agent/references
- agent/remedy
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/abb
- canonical/abb ac500 cpu firmware
- canonical/abb pm573-eth
- version/abb pm573-eth/2.0
- canonical/abb pm583-eth
- version/abb pm583-eth/2.0