CVE-2019-10995 - OpenCVE

ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:A/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Abb	Cp651-web Firmware Cp661-web Cp676 Cp665 Firmware Cp651 Firmware Cp661-web Firmware Cp651 Cp676-web Cp665 Cp676-web Firmware Cp676 Firmware Cp661 Cp651-web Cp661 Firmware Cp665-web Cp665-web Firmware

Configuration 1 [-]

AND

cpe:2.3:o:abb:cp651_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:cp651:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:abb:cp651-web_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:cp651-web:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:abb:cp661-web_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:cp661-web:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:abb:cp661_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:cp661:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:abb:cp665_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:cp665:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:abb:cp665-web_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:cp665-web:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:abb:cp676-web_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:cp676-web:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:abb:cp676_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:abb:cp676:-:*:*:*:*:*:*:*

References

Link	Resource
http://www.securityfocus.com/bid/108928	Third Party Advisory VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-19-178-02	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2020-01-14T16:20:10

Updated: 2020-01-14T16:20:38

Reserved: 2019-04-08T00:00:00

Link: CVE-2019-10995

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-01-14T17:15:12.427

Modified: 2020-01-24T13:53:04.020

Link: CVE-2019-10995

JSON object: View

Redhat Information

No data.

CWE

CWE-798

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:cp651_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "80F3384A-E98E-47DE-ABEB-0B3E810CFA7E", "versionEndIncluding": "bsp_un30_1.76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:cp651:-:*:*:*:*:*:*:*", "matchCriteriaId": "4BD27ACE-A1F6-450C-9853-00F0D87A182A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:cp651-web_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "811CFED9-6A58-4130-AA30-99A949B810FD", "versionEndIncluding": "bsp_un30_1.76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:cp651-web:-:*:*:*:*:*:*:*", "matchCriteriaId": "849EBA94-A50E-4CFF-8C79-EA7E7243EAC9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:cp661-web_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD4EECA8-BFCF-4DA7-AD41-63BC4DEE220A", "versionEndIncluding": "bsp_un30_1.76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:cp661-web:-:*:*:*:*:*:*:*", "matchCriteriaId": "BC8588CE-588A-4C83-BBFE-502E72D006F1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:cp661_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "70980870-5106-4788-B389-584D4CBA8C07", "versionEndIncluding": "bsp_un30_1.76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:cp661:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0691F9D-F6FE-40C2-A538-318F405F47DD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:cp665_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "94A1B857-6E4D-469F-A470-5F495A31405D", "versionEndIncluding": "bsp_un30_1.76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:cp665:-:*:*:*:*:*:*:*", "matchCriteriaId": "FF29C1B8-7CC4-4659-95BF-6B7B37AFC298", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:cp665-web_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "340177AD-D72B-4359-AFCB-57A84B1583D5", "versionEndIncluding": "bsp_un30_1.76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:cp665-web:-:*:*:*:*:*:*:*", "matchCriteriaId": "8068A1EE-D2A5-43E9-A297-47E9916E040A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:cp676-web_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E8270C5-EF9A-4B2F-8BC2-748AA4DBF1B0", "versionEndIncluding": "bsp_un30_1.76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:cp676-web:-:*:*:*:*:*:*:*", "matchCriteriaId": "FF8D95A5-31B9-4366-BC56-489715ED7384", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:abb:cp676_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "79633C26-AC3B-45C4-A072-8FEA4E17F872", "versionEndIncluding": "bsp_un30_1.76", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:abb:cp676:-:*:*:*:*:*:*:*", "matchCriteriaId": "9C9F98FC-D563-4A3F-B189-BD2FED21039D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface."}, {"lang": "es", "value": "La revisi\u00f3n de productos BSP UN30 versi\u00f3n v1.76 y anteriores de ABB CP651 HMI, implementa cuentas administrativas ocultas que son utilizadas durante la fase de aprovisionamiento de la interfaz HMI."}], "id": "CVE-2019-10995", "lastModified": "2020-01-24T13:53:04.020", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-01-14T17:15:12.427", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/108928"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-19-178-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-798"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}