CVE-2020-8477: ABB System 800xA Information Manager Remote Code Execution
The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-8477?
CVE-2020-8477 is categorized as a medium severity vulnerability due to its potential to lead to arbitrary code execution via an XSS-like attack.
How do I fix CVE-2020-8477?
To mitigate CVE-2020-8477, upgrade your installation of ABB System 800xA Information Manager to a version that does not include the vulnerable auxiliary component.
Which versions of ABB System 800xA Information Manager are affected by CVE-2020-8477?
CVE-2020-8477 affects ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2, and 6.1.
What type of attack can be executed due to CVE-2020-8477?
CVE-2020-8477 allows for an XSS-like attack that could lead to the execution of arbitrary code by an authenticated local user.
Is remote access required to exploit CVE-2020-8477?
No, CVE-2020-8477 requires an authenticated local user to perform the exploit.