Medium severity · published Jun 13, 2023
CVE-2023-2876
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows…
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0;0 before 1.0.8; REX640 PCL2: from 1.0;0 before 1.1.4; REX640 PCL3: from 1.0;0 before 1.2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RP
Rex640 Pcl1 Firmware · Abb
1.0.0 before 1.0.8 · source: NVD
RP
Rex640 Pcl2 Firmware · Abb
1.0.0 before 1.1.4 · source: NVD
RP
Rex640 Pcl3 Firmware · Abb
1.0.0 before 1.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2876
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2876
Vendor Advisory
https://search.abb.com/library/Download.aspx?DocumentID=2NGA001423&LanguageCode=en&DocumentPartId=&Action=Launch
More from Rex640 Pcl1 Firmware
6.5
CVE-2022-1596
Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the…
5.5
CVE-2021-22283
Improper Initialization vulnerability in ABB Relion protection relays - 611 series, ABB Relion protection relays - 615 series IEC 4.0 FP1, ABB Relion protection relays - 615…