Riskcovery

CVE-2020-8475

ABB Central Licensing System - Denial of Service Vulnerability

State
Published
Severity
5.3 Medium
Published
Apr 29, 2020
Updated
Aug 4, 2024
Reserved
Jan 30, 2020

Read the record on cve.org

Description

For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5, a weakness in validation of input exists that allows an attacker to block license handling by sending specially crafted messages to the CLS web service.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LABB

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
Central Licensing SystemABB
  • 5.1 to before 5*Affected
ABB Ability System 800xAABB
  • 5.1Affected
  • 6.0Affected
  • 6.1Affected
Compact HMIABB
  • 5.1Affected
  • 6.0Affected
Control Builder SafeABB
  • 1.0Affected
  • 1.1Affected
  • 2.0Affected
Symphony Plus S+ OperationsABB
  • 3 through 3.2Affected
Symphony Plus S+ EngineeringABB
  • 1.1 through 2.2Affected
Composer HarmonyABB
  • 5.1Affected
  • 6.0Affected
  • 6.1Affected
Composer MelodyABB
  • 5.3Affected
  • 6 through 6.3Affected
Harmony OPC Server StandaloneABB
  • 6.0Affected
  • 6.1Affected
  • 7.0Affected
Advant OCS Control Builder AABB
  • 1.3Affected
  • 1.4Affected
Composer CTKABB
  • 6.1Affected
  • 6.2Affected
AdvaBuildABB
  • 3.7 SP1Affected
  • 3.7 SP2Affected
OPC Server for Mod 300 (non-800xA)ABB
  • 1.4Affected
OPC Data LinkABB
  • 2.1Affected
  • 2.2Affected
Knowledge ManagerABB
  • 8.0Affected
  • 9.0Affected
  • 9.1Affected
Manufacturing Operations ManagementABB
  • 1812Affected
  • 1909Affected
Advant OCS AC 100 OPS ServerABB
  • 5.1Affected
  • 6.0Affected
  • 6.1Affected
ABB Ability™ SCADAvantageABB
  • 5.1 to before unspecifiedAffected
  • 5.6.5 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.