CVE-2020-8481

highPriorität · verfolgen · 40EPSS 0.019 · 79. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.85% (79th) EPSS

CVSS 10 · high

Is it mine?

69 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · bewertet 2026-10-27

For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

MitigationABB Ability Knowledge Managercisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationABB Ability Manufacturing Operations Managementcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationABB Ability Symphony Plus - S+ Engineeringcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationABB Ability Symphony Plus - S+ Operationscisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationABB Ability System 800xA / Advant OCS Control Builder Acisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationABB Ability System 800xA and related system extensionscisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationAdvaBuildcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationAdvant OCS AC 100 OPC Servercisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationCompact HMIcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationComposer CTKcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationComposer Harmonycisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationComposer Melody (incl. SPE for Melody 1.0 SPx)cisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationControl Builder Safecisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationHarmony OPC Server (HAOPC)cisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationOPC Data Linkcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
MitigationOPC Server MOD 300 (non-800xA)cisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

10.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 9–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 10

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · cybersecurity@ch.abb.comAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-922USprimärCWE-200USCWE-200US

betroffene Produkte (69)

Betroffene Produkte und Versionsbereiche.

ABB Ability Knowledge Manager: Versions 8.0 9.0 9.1alle Versionencisa_csaf_otUS
ABB Ability Manufacturing Operations Management: Versions 1812 1909alle Versionencisa_csaf_otUS
ABB Ability Symphony Plus - S+ Engineering: Versions 1.1 to 2.2alle Versionencisa_csaf_otUS
ABB Ability Symphony Plus - S+ Operations: Versions 3.0 to 3.2alle Versionencisa_csaf_otUS
ABB Ability System 800xA / Advant OCS Control Builder A: Versions 1.3 1.4alle Versionencisa_csaf_otUS
ABB Ability System 800xA and related system extensions: Versions 5.1 6.0 6.1alle Versionencisa_csaf_otUS
AdvaBuild: Versions 3.7 SP1 3.7 SP2alle Versionencisa_csaf_otUS
Advant OCS AC 100 OPC Server: Versions 5.1 6.0 6.1alle Versionencisa_csaf_otUS
Compact HMI: Versions 5.1 6.0alle Versionencisa_csaf_otUS
Composer CTK: Versions 6.1 6.2alle Versionencisa_csaf_otUS
Composer Harmony: Versions 5.1 6.0 6.1alle Versionencisa_csaf_otUS
Composer Melody (incl. SPE for Melody 1.0 SPx): Versions 5.3 6.1 6.2 6.3alle Versionencisa_csaf_otUS
Control Builder Safe: Versions 1.0 1.1 2.0alle Versionencisa_csaf_otUS
Harmony OPC Server (HAOPC): Standalone Versions 6.0 6.1 7.0alle Versionencisa_csaf_otUS
OPC Data Link: Versions 2.1 2.2alle Versionencisa_csaf_otUS
OPC Server MOD 300 (non-800xA): Version 1.4alle Versionencisa_csaf_otUS
ABB ABB Ability Knowledge Manageralle Versionencisa_csaf_otUS
ABB ABB Ability Manufacturing Operations Managementalle Versionencisa_csaf_otUS
ABB ABB Ability Symphony Plus - S+ Engineering1.1 | → 2.2cisa_csaf_otUS
ABB ABB Ability Symphony Plus - S+ Operations3.0 | → 3.2cisa_csaf_otUS

20 von 69 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-20-154-04ABB Central Licensing System2020-06-02icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to take control of the affected system node remotely and cause an affected CLS Server node to stop or prevent legitimate access to the affected CLS Server.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2020-04-29geändert 2026-06-17

verwandt (402)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2021-27850US	critical9.8	93.6% (100th)	Exploit	2021-04-15
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vu…
CVE-2020-13937US	medium5.3	78.3% (100th)	Exploit	2020-10-19
Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.…
CVE-2021-27170US	critical9.8	15.9% (97th)	—	2021-02-10
An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to t…
CVE-2022-35513US	high7.5OT erhöht	6.04% (93rd)	Exploit	2022-09-07
The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
CVE-2018-25031US	medium4.3	42.3% (99th)	Exploit	2022-03-11
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability t…

+397 weitere

Referenzen (9)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan