9AKK108470A8948

ELSB/Home Solutions Outdated SW Components in ABB Welcome IP-Gateway.

ABB became aware of vulnerabilities in IPGW product versions listed as affected in the advisory. An attacker who successfully exploits these vulnerabilities could potentially gain unauthorized access and potentially compromise the system's - and log-file - confidentiality, integrity and availability. ABB requires that the IP-address of an IPGW should not be accessible from the Internet or any other network considered insecure. The communication between IPGW and the associated Internet Service shall be outbound-initiated, bi-directional. Any unsolicited inbound connection shall be discarded. A common way to ensure this best practice is to operate IPGW behind a firewall. Researchers have reported 2518 CVEs to ABB which were identified using an automated scanning tool in a local network. ABB has analyzed these CVEs carefully and came to the following result: 2074 - CVE's not impacting IPGW because it belongs to SW components inside the IPGW-Firmware-Image, that are not supported by the IPGW as a product, e.g. IPGW does not support: Display, USB-port, Keyboard, etc. 7 - High Severity CVEs that belong to SW components integrated in IPGW-firmware-image. These CVE’s are considered to have a high severity because there are proof of concept (PoC) descriptions available. For cases that are not fixed, ABB was not able to find an appropriate solution. 34 - Medium CVEs that belong to SW components integrated in IPGW-firmware-image. ABB defines a medium severity for CVE’s where there is no PoC available describing how to exploit such CVE and where the CVE belongs to a SW-Component as part of the IPGW-firmware-image, that is frequently used. For cases that are not fixed, ABB was not able to find an appropriate solution. 403 - Low severity CVEs that belong to SW components integrated in IPGW-firmware-image. ABB defines a low severity for CVE’s where there is no PoC available describing how to exploit such CVE and where criticality is seen low. ABB will monitor these CVE’s internally