CVE-2019-18996: abb pb610_panel_builder_600_firmware Improper Protection of Alternate Path
CVSS: 7.8v3.1HighModified
Published 18-12-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-18996 is a high (CVSS 7.8) Improper Protection of Alternate Path vulnerability in abb pb610_panel_builder_600_firmware. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 18-12-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s context.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSources2 sources · 7.1–7.8
- CVE.orgCNA7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:LDiffers
Medium 4.4Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 21-09-2026
21-09-202621-10-2026
EPSS score0.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-424Improper Protection of Alternate PathThe product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
- CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Affected systems
Abb1 product
- pb610_panel_builder_600_firmware≥ unspecified, ≤ 2.8.0.424 | ≤ 2.8.0.424
1 vendor · 1 product