Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-7225

The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are the idal123 password for the IdalMaster account, and the exor password for the exor account. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device. This affects ABB CP635 HMI, CP600 HMIClient, Panel Builder 600, IDAL FTP server, IDAL HTTP server, and multiple other HMI components.

Published

2019-06-27T17:15:15.770

Last Modified

2024-11-21T04:47:47.397

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:A/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

6.5

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-798
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System abb cp620_firmware ≤ 1.76 Yes
Hardware abb cp620 - No
Operating System abb cp620-web_firmware ≤ 1.76 Yes
Hardware abb cp620-web - No
Operating System abb cp630_firmware ≤ 1.76 Yes
Hardware abb cp630 - No
Operating System abb cp630-web_firmware ≤ 1.76 Yes
Hardware abb cp630-web - No
Operating System abb cp635_firmware ≤ 1.76 Yes
Hardware abb cp635 - No
Operating System abb cp635-b_firmware ≤ 1.76 Yes
Hardware abb cp635-b - No
Operating System abb cp635-web_firmware ≤ 1.76 Yes
Hardware abb cp635-web - No
Operating System abb pb610_firmware ≤ 2.8.0.3674 Yes
Hardware abb pb610 - No
Operating System abb cp651-web_firmware ≤ 1.76 Yes
Hardware abb cp651-web - No
Operating System abb cp661_firmware ≤ 1.76 Yes
Hardware abb cp661 - No
Operating System abb cp661-web_firmware ≤ 1.76 Yes
Hardware abb cp661-web - No
Operating System abb cp665_firmware ≤ 1.76 Yes
Hardware abb cp665 - No
Operating System abb cp665-web_firmware ≤ 1.76 Yes
Hardware abb cp665-web - No
Operating System abb cp676_firmware ≤ 1.76 Yes
Hardware abb cp676 - No
Operating System abb cp676-web_firmware ≤ 1.76 Yes
Hardware abb cp676-web - No
Operating System abb cp651_firmware ≤ 1.76 Yes
Hardware abb cp651 - No
References