View CSAF

Summary

ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system.

The following versions of ABB Ability Symphony Plus Engineering are affected:

Ability Symphony Plus 2.2, 2.3, 2.3_RU1, 2.3_RU2, 2.3_RU3, 2.4, 2.4_SP1, 2.4_SP2, 2.4_SP2_RU1

CVSS Vendor Equipment Vulnerabilities

v3 8.8 ABB ABB Ability Symphony Plus Engineering Integer Overflow or Wraparound, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Time-of-check Time-of-use (TOCTOU) Race Condition, Privilege Dropping / Lowering Errors

Background

Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater

Countries/Areas Deployed:…