CVE-2020-24683

highpriority · track · 40EPSS 0.015 · 74 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.48% (74th) EPSS

CVSS 7.5 · high

Is it mine?

10 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-26

The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · cybersecurity@ch.abb.comexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-669USprimaryCWE-305USCWE-602US

affected products (10)

Products and version ranges known to be affected.

ABB ABB Ability™ Symphony® Plus Operationsunspecified → 2.1 SP1enisa_euvdEU
abb symphony + historian= 3.0nvdUScpe:2.3:a:abb:symphony_\+_historian:*:*:*:*:*:*:*:*
abb symphony + historian= 3.1nvdUScpe:2.3:a:abb:symphony_\+_historian:*:*:*:*:*:*:*:*
abb symphony + operations= 1.1nvdUScpe:2.3:a:abb:symphony_\+_operations:*:*:*:*:*:*:*:*
abb symphony + operations= 2.0nvdUScpe:2.3:a:abb:symphony_\+_operations:*:*:*:*:*:*:*:*
abb symphony + operations= 2.1nvdUScpe:2.3:a:abb:symphony_\+_operations:*:*:*:*:*:*:*:*
abb symphony + operations= 3.0nvdUScpe:2.3:a:abb:symphony_\+_operations:*:*:*:*:*:*:*:*
abb symphony + operations= 3.1nvdUScpe:2.3:a:abb:symphony_\+_operations:*:*:*:*:*:*:*:*
abb symphony + operations= 3.2nvdUScpe:2.3:a:abb:symphony_\+_operations:*:*:*:*:*:*:*:*
abb symphony + operations= 3.3nvdUScpe:2.3:a:abb:symphony_\+_operations:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2020-12-22modified 2026-06-17

related (128)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-31431US	—OT critical	98.1% (100th)	KEV	2026-04-22
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the c…
CVE-2021-22900US	high7.2OT critical	14.1% (97th)	KEV	2021-05-27
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a malici…
CVE-2019-13025US	critical9.8	3.35% (89th)	Exploit	2019-10-02
Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a maliciously modified POST (HTT…
CVE-2020-1048US	high7.8	16.5% (97th)	Exploit	2020-05-21
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited…
CVE-2020-5800US	critical9.8	1.58% (75th)	—	2020-12-07
The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify information that they would not normally hav…

+123 more

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan