CVE-2020-24679

moderate-risk
Published 2020-12-22

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted.

Do I need to act?

-
0.76% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (10)

Symphony \+ Historian
Symphony \+ Historian
Symphony \+ Operations
Symphony \+ Operations
Symphony \+ Operations
Symphony \+ Operations
Symphony \+ Operations
Symphony \+ Operations
Symphony \+ Operations
Symphony \+ Operations

Affected Vendors

Abb

References (4)

Mitigation https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=...
Mitigation https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=...
Mitigation https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=...
Mitigation https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=...
45
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 3/34 · Minimal
Exposure 16/34 · Moderate