CVE-2020-8476
mediumpriority · track · 31EPSS 0.015 · 75 %ileEUUSEPSS · scored 2026-10-27
For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5, a weakness in validation of input exists that allows an attacker to alter licenses assigned to the system nodes by sending specially crafted messages to the CLS web service.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationABB Ability Knowledge Managercisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationABB Ability Manufacturing Operations Managementcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationABB Ability Symphony Plus - S+ Engineeringcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationABB Ability Symphony Plus - S+ Operationscisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationABB Ability System 800xA / Advant OCS Control Builder Acisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationABB Ability System 800xA and related system extensionscisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationAdvaBuildcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationAdvant OCS AC 100 OPC Servercisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationCompact HMIcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationComposer CTKcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationComposer Harmonycisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationComposer Melody (incl. SPE for Melody 1.0 SPx)cisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationControl Builder Safecisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationHarmony OPC Server (HAOPC)cisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationOPC Data Linkcisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
- MitigationOPC Server MOD 300 (non-800xA)cisa_csaf_ot
Ensure only authorized individuals have access to user accounts on the system nodes.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (82)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-20-154-04ABB Central Licensing System2020-06-02icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to take control of the affected system node remotely and cause an affected CLS Server node to stop or prevent legitimate access to the affected CLS Server.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2020-8476cnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launchcnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launchcnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launchcnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.1926/cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-154-04cnnvd
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launchenisa_euvd
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launchenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan