High severity · published Jan 14, 2020
CVE-2019-10995
ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cp651 Firmware · Abb
through bsp_un30_1.76 · source: NVD
CF
Cp651-web Firmware · Abb
through bsp_un30_1.76 · source: NVD
CF
Cp661 Firmware · Abb
through bsp_un30_1.76 · source: NVD
CF
Cp661-web Firmware · Abb
through bsp_un30_1.76 · source: NVD
CF
Cp665 Firmware · Abb
through bsp_un30_1.76 · source: NVD
CF
Cp665-web Firmware · Abb
through bsp_un30_1.76 · source: NVD
CF
Cp676 Firmware · Abb
through bsp_un30_1.76 · source: NVD
CF
Cp676-web Firmware · Abb
through bsp_un30_1.76 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10995
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10995
Third Party Advisory
http://www.securityfocus.com/bid/108928
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-178-02
More from Cp651 Firmware
8.8
CVE-2019-7225
The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface