CVE-2019-18995: medium-severity vulnerability in ABB PB610 Panel Builder 600
ABB PB610 HMISimulator does not check content-length of the HTTP request
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
ABB PB610 HMISimulator doesn't properly check the content-length field in HTTP requests, allowing attackers to crash the application by sending specially crafted requests with incorrect content-length values.
The HMISimulator component fails to validate the HTTP content-length header (CWE-20: Improper Input Validation), enabling a remote denial of service attack through malformed HTTP requests. An unauthenticated attacker can send requests with manipulated content-length values to exhaust resources or cause the service to crash.
In the same product, most dangerous first.