High severity · published Jul 23, 2024
CVE-2020-11640
AdvaBuild uses a command queue to launch certain operations
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the
command queue can use it to launch an attack by running any executable on the AdvaBuild node. The
executables that can be run are not limited to AdvaBuild specific executables.
Improper Privilege Management vulnerability in ABB Advant MOD 300 AdvaBuild.This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Advabuild · Abb
3.0 before 3.7; 3.7; 3.7; 3.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11640
Vendor Advisory
https://search.abb.com/library/Download.aspx?DocumentID=3BUA003421&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.200044199.882581162.1721753430-284724496.1718609177
More from Advabuild
7.8
CVE-2020-11639
An attacker could exploit the vulnerability by injecting garbage data or specially crafted data