CVE-2019-7232: abb pb610_panel_builder_600_firmware Out-of-bounds Write

Vulnerability summary

CVE-2019-7232 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in abb pb610_panel_builder_600_firmware. EPSS estimates a 52.09% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 24-06-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address, which can then be leveraged to execute attacker-controlled code on the server.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.