System 800xA 5.1.x, 6.0.3.x, 6.1.1.x, 6.2.x - VideONet Camera passwords stored in clear text
ABB is aware of a vulnerability related to the VideONet product. The vulnerability is applicable in the System 800xA versions listed as affected in the advisory, where the VideONet product is used. There will be no update/resolution of this vulnerability in System 800xA. Instead, the strategy for ABB is to offer existing customers using VideONet a transfer to a new product, Camera Connect. This will be offered as soon as Camera Connect is available as a product. An attacker who successfully exploited the vulnerability could, in the worst-case scenario, stop or manipulate the video feed. There is no impact to other Operator station functions (graphics, trends, faceplates, etc.) and Control operations are not impacted at all.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-10334US | — | — | ||
A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used.
An attacker who successfully exploited the vulnerability coul… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (1)
- Kein Fix geplantSystem 800xA
ABB recommends following the guidelines described in the System 800xA VideONet Connect user documentation (2PAA109407*). The user documentation explains how to protect the network on which cameras are connected from unauthorized access and the recommended deployment. Similarly, it is important to protect the VideONet Server from unauthorized access. There will be no update for VideONet in System 800xA. Instead, the recommendation is to transfer to the new product, Camera Connect, as soon as it becomes available. Camera Connect is expected to be released in the first half of 2025. Customers may proactively reach out to their ABB contact in case they would like to receive further information about the new Camera Connect solution. Ensure that the camera user accounts used by System 800xA only have the minimum level of permission needed to perform the required task, e.g. do not use an administrator or superuser account. This limits the potential damage from a leaked password.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan