Details of VAR-202004-0657

ID

VAR-202004-0657

CVE

CVE-2019-5620

TITLE

ABB MicroSCADA Pro SYS600 Access Control Error Vulnerability

Trust: 1.6

sources: IVD: d5816d51-dd65-4b53-a03d-b5a77883386c // IVD: baa1c90a-c3bd-4764-9ea3-66a131059a14 // CNVD: CNVD-2020-27090 // CNNVD: CNNVD-202004-2435

DESCRIPTION

ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function. (DoS) It may be put into a state. ABB MicroSCADA Pro SYS600 is a set of monitoring and data acquisition software of Swiss ABB company. The software is mainly used for substation automation, SCADA electrical, distribution management applications and industrial power management. ABB MicroSCADA Pro SYS600 version 9.3 has an access control error vulnerability, which originated from a network system or product incorrectly restricting access to resources from unauthorized roles. No detailed vulnerability details are currently available

Trust: 2.61

sources: NVD: CVE-2019-5620 // JVNDB: JVNDB-2019-015512 // CNVD: CNVD-2020-27090 // IVD: d5816d51-dd65-4b53-a03d-b5a77883386c // IVD: baa1c90a-c3bd-4764-9ea3-66a131059a14 // VULMON: CVE-2019-5620

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 1.0

sources: IVD: d5816d51-dd65-4b53-a03d-b5a77883386c // IVD: baa1c90a-c3bd-4764-9ea3-66a131059a14 // CNVD: CNVD-2020-27090

AFFECTED PRODUCTS

vendor:	abb	model:	microscada pro sys600	scope:	eq	version:	9.3	Trust: 1.5
vendor:	hitachienergy	model:	microscada pro sys600	scope:	eq	version:	9.3	Trust: 1.0
vendor:	microscada pro sys600	model:	-	scope:	eq	version:	9.3	Trust: 0.4

sources: IVD: d5816d51-dd65-4b53-a03d-b5a77883386c // IVD: baa1c90a-c3bd-4764-9ea3-66a131059a14 // CNVD: CNVD-2020-27090 // VULMON: CVE-2019-5620 // JVNDB: JVNDB-2019-015512 // NVD: CVE-2019-5620

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-5620
value:	CRITICAL
Trust: 1.0
NVD:	JVNDB-2019-015512
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2020-27090
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202004-2435
value:	MEDIUM
Trust: 0.6
IVD:	d5816d51-dd65-4b53-a03d-b5a77883386c
value:	MEDIUM
Trust: 0.2
IVD:	baa1c90a-c3bd-4764-9ea3-66a131059a14
value:	MEDIUM
Trust: 0.2
VULMON:	CVE-2019-5620
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-5620
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2019-015512
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-27090
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	d5816d51-dd65-4b53-a03d-b5a77883386c
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
IVD:	baa1c90a-c3bd-4764-9ea3-66a131059a14
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2019-5620
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2019-015512
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

PROBLEMTYPE DATA

problemtype:

CWE-306

Trust: 1.8

sources: JVNDB: JVNDB-2019-015512 // NVD: CVE-2019-5620

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-2435

TYPE

Access control error

Trust: 1.0

sources: IVD: d5816d51-dd65-4b53-a03d-b5a77883386c // IVD: baa1c90a-c3bd-4764-9ea3-66a131059a14 // CNNVD: CNNVD-202004-2435

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015512

PATCH

title:

Top Page

url:

https://new.abb.com/

Trust: 0.8

sources: JVNDB: JVNDB-2019-015512

EXTERNAL IDS

db:	NVD	id:	CVE-2019-5620	Trust: 3.5
db:	CNVD	id:	CNVD-2020-27090	Trust: 1.0
db:	CNNVD	id:	CNNVD-202004-2435	Trust: 1.0
db:	JVNDB	id:	JVNDB-2019-015512	Trust: 0.8
db:	IVD	id:	D5816D51-DD65-4B53-A03D-B5A77883386C	Trust: 0.2
db:	IVD	id:	BAA1C90A-C3BD-4764-9EA3-66A131059A14	Trust: 0.2
db:	VULMON	id:	CVE-2019-5620	Trust: 0.1

REFERENCES

url:	https://www.rapid7.com/db/modules/exploit/windows/scada/abb_wserver_exec	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-5620	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-5620	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/306.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2020-27090 // VULMON: CVE-2019-5620 // JVNDB: JVNDB-2019-015512 // CNNVD: CNNVD-202004-2435 // NVD: CVE-2019-5620

SOURCES

db:	IVD	id:	d5816d51-dd65-4b53-a03d-b5a77883386c
db:	IVD	id:	baa1c90a-c3bd-4764-9ea3-66a131059a14
db:	CNVD	id:	CNVD-2020-27090
db:	VULMON	id:	CVE-2019-5620
db:	JVNDB	id:	JVNDB-2019-015512
db:	CNNVD	id:	CNNVD-202004-2435
db:	NVD	id:	CVE-2019-5620

LAST UPDATE DATE

2024-11-23T22:48:02.248000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-27090	date:	2020-05-08T00:00:00
db:	VULMON	id:	CVE-2019-5620	date:	2020-05-06T00:00:00
db:	JVNDB	id:	JVNDB-2019-015512	date:	2020-05-29T00:00:00
db:	CNNVD	id:	CNNVD-202004-2435	date:	2020-05-15T00:00:00
db:	NVD	id:	CVE-2019-5620	date:	2024-11-21T04:45:15.187

SOURCES RELEASE DATE

db:	IVD	id:	d5816d51-dd65-4b53-a03d-b5a77883386c	date:	2020-04-29T00:00:00
db:	IVD	id:	baa1c90a-c3bd-4764-9ea3-66a131059a14	date:	2020-04-29T00:00:00
db:	CNVD	id:	CNVD-2020-27090	date:	2020-05-08T00:00:00
db:	VULMON	id:	CVE-2019-5620	date:	2020-04-29T00:00:00
db:	JVNDB	id:	JVNDB-2019-015512	date:	2020-05-29T00:00:00
db:	CNNVD	id:	CNNVD-202004-2435	date:	2020-04-29T00:00:00
db:	NVD	id:	CVE-2019-5620	date:	2020-04-29T23:15:13.033