ABB PB610 Panel Builder 600

1. EXECUTIVE SUMMARY

• CVSS v3 8.8
• ATTENTION: Low skill level to exploit
• Vendor: ABB
• Equipment: PB610 Panel Builder 600
• Vulnerabilities: Use of Hard-coded Credentials, Improper Authentication, Relative Path Traversal, Improper Input Validation, Stack-based Buffer Overflow

2. RISK EVALUATION

An attacker who successfully exploits these vulnerabilities could prevent legitimate access to an affected system node, remotely cause an affected system node to stop, take control of an affected system node, or insert and run arbitrary code in an affected system node.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of PB610 Panel Builder 600, an engineering tool for designing HMI applications and the runtime for control panels, which are used for the operation of automation systems, are affected:

• PB610 Panel Builder 600, order code: 1SAP500900R0101, Versions 1.91 … 2.8.0.367 and prior.

3.2 VULNERABILITY OVERVIEW

3.2.1    USE OF HARD-CODED CREDENTIALS CWE-798

The ABB CP635 HMI component implements hidden administrative accounts used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool “Panel Builder 600” to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials.

CVE-2019-7225 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.2    IMPROPER AUTHENTICATION CWE-287

The IDAL HTTP server CGI interface contains a URL, which allows an unauthenticated attacker to bypass authentication and gain access to privileged functions.

CVE-2019-7226 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.3    RELATIVE PATH TRAVERSAL CWE-23

The IDAL FTP server fails to ensure directory change requests do not change to locations outside of the root FTP directory. An authenticated attacker can simply traverse outside the server root directory by changing the directory.

CVE-2019-7227 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

3.2.4    IMPROPER INPUT VALIDATION CWE-20

The IDAL HTTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server.

CVE-2019-7228 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.5    IMPROPER INPUT VALIDATION CWE-20

The IDAL FTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server.

CVE-2019-7230 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.6    STACK-BASED BUFFER OVERFLOW CWE-121

The IDAL HTTP server is vulnerable to a stack-based buffer overflow when a large host header is sent in a HTTP request. The host header value overflows a buffer and can overwrite the Structured Exception Handler (SEH) address with a large chunk of data.

CVE-2019-7232 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.7    STACK-BASED BUFFER OVERFLOW CWE-121

The IDAL FTP server is vulnerable to a buffer overflow when a large string is sent by an authenticated attacker. This overflow is handled, but terminates the process.

CVE-2019-7231 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Chemical, Critical Manufacturing, Dams, Energy, Food and Agriculture, Water and Wastewater
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Switzerland

3.4 RESEARCHER

Xen1thLabs, a Darkmatter Company, United Arab Emirates, and Abu Dhabi reported these vulnerabilities to ABB.

4. MITIGATIONS

The problems are corrected in the following product versions:

PB610 Panel Builder 600 v2.8.0.424.

New version of BSP (board support package) UN31 v2.31.

New version of BSP (board support package) UN30 v2.31.

ABB recommends users apply the update of the PB610 applications on CP600 control panels at the earliest convenience.

If an update of the devices is not possible. ABB recommends users restrict network access to the devices to only trusted parties/devices.

To prevent an unauthorized login via a remote client, leave the “Force Remote Login” option of the security settings checked (default setting). In addition, set new users and passwords in the user’s settings for remote clients to “use different user and password.”

ABB’s recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include :

• Restrict physical access to process control systems to authorized personnel,
• Do not have direct connections to the Internet,
• Separate from other networks by means of a firewall system with a minimal number of exposed ports,
• Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.
• Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.

More information on ABB’s recommended practices can be found in the following document:

3BSE032547, Whitepaper – Security for Industrial Automation and Control Systems

For additional information and support please contact the local ABB service organization. For contact information, see: https://new.abb.com/contact-centers.

Information about ABB’s cybersecurity program and capabilities can be found at: http://www.abb.com/cybersecurity.

For more information see ABB’s security advisory 3ADR010377.

NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

• When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.

NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.



NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.



Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.

No known public exploits specifically target these vulnerabilities. If a control panel with a PB610 HMI application is connected to a network, an attacker who has network access to an affected system node could exploit these vulnerabilities. If the control panel is not connected to a network, an attacker would need to have physical access to an affected system node to exploit these vulnerabilities.

• ABB