Sign-up

ID

VAR-201911-1040


CVE

CVE-2019-18253


TITLE

ABB Relion 670 Series path traversal vulnerability

Trust: 1.4

sources: IVD: eff24a4b-dacf-456a-8d72-0a1be88ae5b6 // CNVD: CNVD-2019-44532 // CNNVD: CNNVD-201911-1410

DESCRIPTION

An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.17, 2.0.0.10, RES670 2.0.0.4, 2.1.0.1, and prior) outside the intended directory. Relion 670 The series contains a path traversal vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ABB Relion 670 Series is a transmission protection control device of Swiss ABB company

Trust: 2.34

sources: NVD: CVE-2019-18253 // JVNDB: JVNDB-2019-013152 // CNVD: CNVD-2019-44532 // IVD: eff24a4b-dacf-456a-8d72-0a1be88ae5b6

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: eff24a4b-dacf-456a-8d72-0a1be88ae5b6 // CNVD: CNVD-2019-44532

AFFECTED PRODUCTS

vendor:hitachienergymodel:relion 670scope:gteversion:1.2

Trust: 1.0

vendor:hitachienergymodel:relion 670scope:gteversion:2.0

Trust: 1.0

vendor:hitachienergymodel:relion 670scope:ltversion:1p1r26

Trust: 1.0

vendor:hitachienergymodel:relion 670scope:gteversion:2.1

Trust: 1.0

vendor:hitachienergymodel:relion 670scope:ltversion:2.0.0.10

Trust: 1.0

vendor:hitachienergymodel:relion 670scope:ltversion:2.1.0.1

Trust: 1.0

vendor:hitachienergymodel:relion 670scope:ltversion:1.2.3.17

Trust: 1.0

vendor:relion 670model: - scope:eqversion:*

Trust: 0.8

vendor:abbmodel:relion 670scope: - version: -

Trust: 0.8

vendor:abbmodel:relionscope:eqversion:670<=2.1.0.1

Trust: 0.6

vendor:abbmodel:relion <=1p1r26scope:eqversion:670

Trust: 0.6

vendor:abbmodel:relionscope:eqversion:670<=1.2.3.17

Trust: 0.6

vendor:abbmodel:relionscope:eqversion:670<=2.0.0.10

Trust: 0.6

vendor:abbmodel:relion 670scope:eqversion:1.2.3.18

Trust: 0.6

vendor:abbmodel:relion 670scope:eqversion: -

Trust: 0.6

sources: IVD: eff24a4b-dacf-456a-8d72-0a1be88ae5b6 // CNVD: CNVD-2019-44532 // JVNDB: JVNDB-2019-013152 // CNNVD: CNNVD-201911-1410 // NVD: CVE-2019-18253

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-18253
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-18253
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2019-44532
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201911-1410
value: CRITICAL

Trust: 0.6

IVD: eff24a4b-dacf-456a-8d72-0a1be88ae5b6
value: CRITICAL

Trust: 0.2

nvd@nist.gov: CVE-2019-18253
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-44532
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: eff24a4b-dacf-456a-8d72-0a1be88ae5b6
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2019-18253
baseSeverity: CRITICAL
baseScore: 10.0
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2019-18253
baseSeverity: CRITICAL
baseScore: 10.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: eff24a4b-dacf-456a-8d72-0a1be88ae5b6 // CNVD: CNVD-2019-44532 // JVNDB: JVNDB-2019-013152 // CNNVD: CNNVD-201911-1410 // NVD: CVE-2019-18253

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.8

sources: JVNDB: JVNDB-2019-013152 // NVD: CVE-2019-18253

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-1410

TYPE

Path traversal

Trust: 0.8

sources: IVD: eff24a4b-dacf-456a-8d72-0a1be88ae5b6 // CNNVD: CNNVD-201911-1410

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-013152

PATCH
title:Top Pageurl:https://new.abb.com/
Trust: 0.8
title:Patch for ABB Relion 670 Series Path Traversal Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/193463
Trust: 0.6
title:ABB Relion 670 Series Repair measures for path traversal vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=103654
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-44532 // 
            
            
            
            JVNDB: JVNDB-2019-013152 // 
            
            
            
            CNNVD: CNNVD-201911-1410

EXTERNAL IDS
db:NVDid:CVE-2019-18253
Trust: 3.2
db:ICS CERTid:ICSA-19-330-01
Trust: 3.0
db:CNVDid:CNVD-2019-44532
Trust: 0.8
db:CNNVDid:CNNVD-201911-1410
Trust: 0.8
db:JVNDBid:JVNDB-2019-013152
Trust: 0.8
db:AUSCERTid:ESB-2019.4483
Trust: 0.6
db:IVDid:EFF24A4B-DACF-456A-8D72-0A1BE88AE5B6
Trust: 0.2
sources:
            
            
            IVD: eff24a4b-dacf-456a-8d72-0a1be88ae5b6 // 
            
            
            
            CNVD: CNVD-2019-44532 // 
            
            
            
            JVNDB: JVNDB-2019-013152 // 
            
            
            
            CNNVD: CNNVD-201911-1410 // 
            
            
            
            NVD: CVE-2019-18253

REFERENCES
url:https://www.us-cert.gov/ics/advisories/icsa-19-330-01
Trust: 3.6
url:https://nvd.nist.gov/vuln/detail/cve-2019-18253
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-18253
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2019.4483/
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-44532 // 
            
            
            
            JVNDB: JVNDB-2019-013152 // 
            
            
            
            CNNVD: CNNVD-201911-1410 // 
            
            
            
            NVD: CVE-2019-18253

SOURCES
db:IVDid:eff24a4b-dacf-456a-8d72-0a1be88ae5b6
db:CNVDid:CNVD-2019-44532
db:JVNDBid:JVNDB-2019-013152
db:CNNVDid:CNNVD-201911-1410
db:NVDid:CVE-2019-18253

LAST UPDATE DATE
2024-11-23T23:11:37.799000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-44532date:2019-12-10T00:00:00
db:JVNDBid:JVNDB-2019-013152date:2019-12-20T00:00:00
db:CNNVDid:CNNVD-201911-1410date:2019-12-18T00:00:00
db:NVDid:CVE-2019-18253date:2024-11-21T04:32:55.600

SOURCES RELEASE DATE
db:IVDid:eff24a4b-dacf-456a-8d72-0a1be88ae5b6date:2019-12-10T00:00:00
db:CNVDid:CNVD-2019-44532date:2019-12-10T00:00:00
db:JVNDBid:JVNDB-2019-013152date:2019-12-20T00:00:00
db:CNNVDid:CNNVD-201911-1410date:2019-11-26T00:00:00
db:NVDid:CVE-2019-18253date:2019-11-27T23:15:10.867