CVE-2020-24674: high-severity vulnerability in ABB Ability™ Symphony® Plus Historian
Improper Authorization in Symphony Plus
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Symphony Plus has a flaw where some commands don't properly check if users are allowed to run them. This means an authenticated user could perform actions they shouldn't have access to, like crashing the system or running malicious code.
CWE-285 improper authorization vulnerability in S+ Operations and S+ Historian allows authenticated but insufficiently-privileged users to bypass permission checks on certain client commands, enabling DoS attacks, arbitrary code execution, or privilege escalation via unvalidated command execution.
In the same product, most dangerous first.