CVE-2020-24679: high-severity vulnerability in ABB Ability™ Symphony® Plus Historian
Denial of Service attack on Symphony Plus
Published · Updated
Follow this CVE+ Monitor ABB Ability™ Symphony® Plus Operations+ Monitor ABB Ability™ Symphony® Plus Historian
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.9%
In short
Symphony Plus services can be crashed or compromised by sending specially crafted messages over the network. This allows attackers to disrupt operations or potentially take control of the affected system.
Technical detail
CWE-20 input validation flaw in S+ Operations and S+ Historian services allows remote attackers to trigger denial of service or arbitrary code execution via malformed messages without requiring authentication or special privileges.
Summary generated and translated by AI from the official description.
A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
ABB · ABB Ability™ Symphony® Plus HistorianABB · ABB Ability™ Symphony® Plus OperationsRelated CVEs — ABB Ability™ Symphony® Plus Historian
In the same product, most dangerous first.
CVE-2020-24674HIGHImproper Authorization in Symphony PlusEPSS 3.1%CVE-2020-24678HIGHPotential Privilege Escalation in Symphony PlusEPSS 1.5%CVE-2020-24683CRITICALAuthentication Bypass in Symphony PlusEPSS 1.5%CVE-2020-24677HIGHInsecure Web Service in Symphony PlusEPSS 1.4%CVE-2020-24675CRITICALWeak Authentication in Symphony PlusEPSS 1.2%CVE-2020-24673CRITICALSQL Injection in Symphony PlusEPSS 1.1%