Description
The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the username %s%p%x%d will crash the server. Sending %08x.AAAA.%08x.%08x will log memory content from the stack.
References (5)
Scores
CVSS v3
8.8
EPSS
0.0243
EPSS Percentile
85.2%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-134
Status
published
Products (1)
abb/pb610_panel_builder_600_firmware
1.91 - 2.8.0.367
Published
Jun 24, 2019
Tracked Since
Feb 18, 2026