CVE-2019-19089

mediumpriority · track · 24EPSS 0.011 · 65 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.07% (65th) EPSS

CVSS 4.3 · medium

Is it mine?

5 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text interpreted as JavaScript.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedeSOMScisa_csaf_ot
ABB recommends users update their version of eSOMS to 6.0.3 or 6.1.
MitigationeSOMScisa_csaf_ot
For additional information and support please contact an ABB service organization. For contact information, see https://new.abb.com/contact-centers or see ABB security advisory number ABBVU-PGGA-2018035.
https://new.abb.com/contact-centers

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7

v3.06.1mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · CISA US

v3.16.1mediumAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · cybersecurity@ch.abb.comexploitability 2.8 · impact 2.7

v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-436USprimaryCWE-94USprimaryCWE-16USCWE-16USCWE-436USCWE-693USCWE-94US

affected products (5)

Products and version ranges known to be affected.

eSOMS: 6.02 and priorall versionscisa_csaf_otUS
ABB eSOMS≤ 6.02cisa_csaf_otUS
ABB eSOMS≤ 4.0 to 6.0.3enisa_euvdEU
ABB eSOMS4.0 → 6.0.3fstec_bduRU
hitachienergy esoms4.0 → 6.0.3nvdUScpe:2.3:a:hitachienergy:esoms:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-20-072-01ICSA-20-072-01_ABB eSOMS2020-03-12icsa · cisa_csaf_otUS
ABB reported these vulnerabilities to CISA.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

published 2020-04-02modified 2026-06-17

related (10,652)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-0322US	high7.2OT critical	1.74% (78th)	KEV	2026-10-14
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbi…
CVE-2026-58400US	—OT critical	1.19% (68th)	—	2026-09-03
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured…
CVE-2026-60004US	—OT critical	24.0% (98th)	KEV	2026-08-26
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
CVE-2026-72530US	—OT critical	1.69% (77th)	KEV	2026-08-19
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a special…
CVE-2026-65660US	high8.8OT critical	8.19% (95th)	KEV	2026-08-11
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

+10647 more

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan