Medium severity · published Jul 24, 2023
CVE-2023-3323
Code Execution through overwriting project file on zenon engineering studio system
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted
programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts.
This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
ABB Ability™ zenon · ABB
11 build through 11 build 106404 · source: vendor
ZE
Zenon · Abb
through 11.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3323
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3323
Mitigation
https://search.abb.com/library/Download.aspx?DocumentID=2NGA001801&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.194142766.2067879716.1690216773-1911411808.1686627590
More from ABB Ability™ zenon
8.8
CVE-2023-3321
Code Execution through Writable Mosquitto Configuration File
8.1
CVE-2023-3322
Code Execution through overwriting service executable in utilities directory
7.5
CVE-2023-3324
Insecure deserialization in zenon internal DLLs