ABB Vulnerabilities and Affected Products
Vulnerabilities associated with ANC-mini.
Products
Clear product- ASPECT-Enterprise58 vulnerabilities
- MATRIX Series58 vulnerabilities
- NEXUS Series58 vulnerabilities
- matrix_series22 vulnerabilities
- nexus_series22 vulnerabilities
- aspect_enterprise21 vulnerabilities
- eSOMS13 vulnerabilities
- ABB Ability™ Symphony® Plus Operations9 vulnerabilities
- ABB Ability™ Symphony® Plus Historian8 vulnerabilities
- AdvaBuild7 vulnerabilities
- FLXEON7 vulnerabilities
- Symphony Plus S+ Operations7 vulnerabilities
- Control Builder Safe6 vulnerabilities
- Symphony Plus S+ Engineering6 vulnerabilities
- ABB Ability System 800xA5 vulnerabilities
- Advant OCS AC 100 OPS Server5 vulnerabilities
- Advant OCS Control Builder A5 vulnerabilities
- Central Licensing System5 vulnerabilities
- Compact HMI5 vulnerabilities
- Composer CTK5 vulnerabilities
- Composer Harmony5 vulnerabilities
- Composer Melody5 vulnerabilities
- Harmony OPC Server Standalone5 vulnerabilities
- Knowledge Manager5 vulnerabilities
- Manufacturing Operations Management5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-9877MEDIUM | Sensitive information submitted using GET method: Use of GET Request Method With Sensitive Query Strings vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4. CWE-598Apr 30, 2025 | CVSS5.3v4.0 | EPSS0.211% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-9876HIGH | Application is vulnerable to Privilege escalation: Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4. CWE-471Apr 30, 2025 | CVSS8.5v4.0 | EPSS0.269% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Unverified Password ChangeUnverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI This issue affects ANC software version 1.1.4 and earlier. CWE-620Apr 30, 2025 | CVSS2.1v4.0 | EPSS0.187% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |