Riskcovery

CVE-2024-8036

Unauthorized Modifications of Firmware and Configuration

State
Published
Severity
4.6 Medium
Published
Oct 25, 2024
Updated
Oct 30, 2024
Reserved
Aug 20, 2024

Read the record on cve.org

Description

ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a specially crafted firmware or configuration to the system node, causing the node to stop, become inaccessible, or allowing the attacker to take control of the node.

Scores

CVSSScoreVectorSource
4.04.6 MediumCVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:N/R:I/V:D/RE:H/U:AmberABB
3.15.9 MediumCVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:HABB

Weaknesses

  • CWE-347 Improper Verification of Cryptographic Signature

Affected Products

ProductVersions
Relion Protection Relays RE_611 IECABB
  • 1.0.0 through 1.0.4Affected
  • 2.0.0 through 2.0.4Affected
Relion Protection Relays REF615 IECABB
  • 1.0.0 through 1.2.0Affected
Relion Protection Relays REF615 ANSIABB
  • 1.0.0 through 1.1.0Affected
Relion Protection Relays REX615ABB
  • PCL1Affected
Relion Protection Relays REX610ABB
  • 1.1.1Affected
  • 1.2.0Affected
Relion Protection Relays REX640ABB
  • 1.0.0 through 1.0.8Affected
  • 1.1.0 through 1.1.6Affected
  • 1.2.0 through 1.2.3Affected
  • 1.3.0 through 1.3.4Affected
Substation Merging Unit SMU615ABB
  • 1.0.0 through 1.0.3Affected
Smart Substation Control and Protection SSC600ABB
  • 1.0Affected
  • 1.0 FP1Affected
  • 1.0 FP2Affected
  • 1.0 FP3Affected
  • 1.0 FP4Affected
Relion Protection Relays REF615R ANSIABB
  • 4.0.0 through 4.1.2Affected
Relion Protection Relays RED615 IECABB
  • 1.0.0 through 1.1.5Affected
Relion Protection Relays 615 series IECABB
  • 2.0.0 through 2.0.9Affected
  • 3.0.0 through 3.0.10Affected
  • 4.0.0 through 4.0.8Affected
  • 4.1.9 through 4.1.10Affected
  • 5.0.0 through 5.0.17Affected
  • 5.1.0 through 5.1.24Affected
Relion Protection Relays 615 series CNABB
  • 2.0.0 through 2.0.9Affected
  • 3.0.0 through 3..0.7Affected
  • 3.1.0 through 3.1.10Affected
  • 4.1.0 through 4.1.9Affected
  • 5.1.0 through 5.1.4Affected
Relion Protection Relays 615 series ANSIABB
  • 2.0.0 through 2.0.9Affected
  • 4.0.0 through 4.0.5Affected
  • 4.1.0 through 4.1.1Affected
  • 4.2.0 through 4.2.3Affected
  • 5.1.0 through 5.1.3Affected
Relion Protection Relays RER615ABB
  • 1.0.0 through 1.1.4Affected
  • 2.0.0 through 2.0.9Affected
Relion Protection Relays REC615ABB
  • 1.0.0 through 1.1.4Affected
  • 2.0.0 through 2.0.9Affected
RBX615ABB
  • 1.0.0 through 2.0.0Affected
RER620 ANSIABB
  • 1.0.0 through 1.3Affected
620 Series IEC/CNABB
  • 2.0.0 through 2.0.13Affected
  • 2.1.0 through 2.1.16Affected
RE_630ABB
  • 1.1.0 through 1.1.0 C5Affected
  • 1.2.0 through 1.2.0 B8Affected
  • 1.3.0 through 1.3.0 B1Affected
RIO600ABB
  • 1.0.0 through 1.8.8Affected
COM600ABB
  • 3.3Affected
  • 3.4Affected
  • 3.5Affected
  • 4.0Affected
  • 4.1Affected
  • 5.0Affected
  • 5.1Affected
SPA ZC-400ABB
  • ExxAffected
  • MxxAffected
  • SxxAffected
  • xMxAffected
  • ExxxAffected
  • MxxxAffected
  • SxxxAffected
  • xMxxAffected
  • xxxCAffected
COM600F ANSIABB
  • 4.1Affected
  • 5.0Affected
SPA ZC-402ABB
  • ExxxAffected
  • MxxxAffected
  • SxxxAffected
  • xMxxAffected
  • xxxCAffected
REF542plusABB
  • R1.0Affected
  • R1.1Affected
  • R2.0Affected
  • R2.5Affected
  • R2.5 ATEXAffected
  • R2.5 SP3Affected
  • R2.6Affected
  • R3.0Affected
  • R3.0 SP1Affected
  • R3.0 SP3Affected
SUE 3000ABB
  • 2.6 V4F07xAffected
  • 3.0FP1 V4F11xAffected
  • V4D02xAffected
  • V4E0xxAffected
ARG600/ARP600/ARR600/ARC600 single SIMABB
  • 3.x.x through 3.4.13Affected
ARG600/ARP600 dual SIMABB
  • 2.x.x through 3.4.13Affected
ARM600ABB
  • 4.x.x through 5.0.3Affected
REC601/RER601ABB
  • 1.1 through 1.2Affected
REC603/RER603ABB
  • 1.1 through 1.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.