CVE-2024-0335highCWE-23

CVE-2024-0335: falha de alta gravidade em ABB Symphony Plus S+ Operations

Malformed Packet Handling

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Symphony Plus S+ Operations+ Monitorar Symphony Plus S+ Engineering

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.6%
ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products (e.g., S+ Operations, S+ Engineering and S+ Analyst) This issue affects Symphony Plus S+ Operations: from 3..0;0 through 3.3 SP1 RU4, from 2.1;0 through 2.1 SP2 RU3, from 2.0;0 through 2.0 SP6 TC6; Symphony Plus S+ Engineering: from 2.1 through 2.3 RU3; Symphony Plus S+ Analyst: from 7.0.0.0 through 7.2.0.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
ABB · Symphony Plus S+ AnalystABB · Symphony Plus S+ EngineeringABB · Symphony Plus S+ Operations
CVEs relacionadas — ABB Symphony Plus S+ Operations

No mesmo produto, das mais perigosas para as menos.

CVE-2020-8479CRITICALABB Central Licensing System - XML External Entity InjectionEPSS 2.3%CVE-2020-8481CRITICALABB Central Licensing System - Information disclosureEPSS 1.9%CVE-2020-8476MEDIUMABB Central Licensing System - Elevation of Privilege VulnerabilityEPSS 1.5%CVE-2020-8475MEDIUMABB Central Licensing System - Denial of Service VulnerabilityEPSS 1.2%CVE-2020-8471HIGHABB Central Licensing System - Weak File PermissionsEPSS 0.4%CVE-2023-0228HIGHImproper authentication vulnerability in S+ OperationsEPSS 0.3%