CVE-2019-7230: abb pb610_panel_builder_600_firmware

Vulnerability summary

CVE-2019-7230 is a high (CVSS 8.8) vulnerability in abb pb610_panel_builder_600_firmware. EPSS estimates a 3.71% chance of exploitation in the next 30 days, higher than 89.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 24-06-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the username %s%p%x%d will crash the server. Sending %08x.AAAA.%08x.%08x will log memory content from the stack.

• CWE-134Use of Externally-Controlled Format StringThe product uses a function that accepts a format string as an argument, but the format string originates from an external source.