CVE-2019-7228: Abb PB610 Panel Builder 600 Firmware

High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days.

The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate with the username %25s%25p%25x%25n will crash the server. Sending %08x.AAAA.%08x.%08x will log memory content from the stack.

Affected products

• Abb PB610 Panel Builder 600 Firmware: from 1.91, up to and including 2.8.0.367

Published 2019-06-27. Last modified 2026-06-17.