CVE-2020-24675

CRITICAL

ABB Symphony+ Historian and Operations - Unauthenticated Arbitrary Value Injection to Process Control

Title source: llm
STIX 2.1

Description

In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History server) and ultimately write values to the controlled process.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0043
EPSS Percentile 62.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-287
Status published
Products (9)
abb/symphony_\+_historian 3.0
abb/symphony_\+_historian 3.1
abb/symphony_\+_operations 1.1
abb/symphony_\+_operations 2.0
abb/symphony_\+_operations 2.1 sp1 (2 CPE variants)
abb/symphony_\+_operations 3.0
abb/symphony_\+_operations 3.1
abb/symphony_\+_operations 3.2
abb/symphony_\+_operations 3.3
Published Dec 22, 2020
Tracked Since Feb 18, 2026