Abb PB610 Panel Builder 600 Firmware vulnerabilities

6 CVEs affecting Abb PB610 Panel Builder 600 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-7227, published 2019-06-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-7232, published 2019-06-24. High severity, CVSS 8.8. EPSS: 52.1% chance of exploitation in the next 30 days. The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler…
CVE-2019-7227, published 2019-06-27. High severity, CVSS 7.3. EPSS: 8.5% chance of exploitation in the next 30 days. In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the FTP server functionality to download and upload files. An…
CVE-2019-7231, published 2019-06-24. Medium severity, CVSS 5.7. EPSS: 6.7% chance of exploitation in the next 30 days. The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled, but terminates the process. An authenticated attacker can…
CVE-2019-7226, published 2019-06-27. High severity, CVSS 8.8. EPSS: 5.3% chance of exploitation in the next 30 days. The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. Specifically, /cgi/loginDefaultUser…
CVE-2019-7228, published 2019-06-27. High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days. The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate with the username %25s%25p%25x%25n will crash the server.…
CVE-2019-7230, published 2019-06-24. High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days. The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the username %s%p%x%d will crash the server. Sending…