{"schemaVersion":3,"id":"CVE-2020-8475","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5, a weakness in validation of input exists that allows an attacker to block license handling by sending specially crafted messages to the CLS web service.","dates":{"published":"2020-04-29T00:00:00.000Z","modified":"2024-08-04T10:03:44.814Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":2.1,"severity":"low","vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01154,"percentile":0.66695,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.01154},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.01154,"percentile":0.66695}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01154,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.01154,"percentile":0.66695}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"abb","product":"800xa_system","name":"800xa system","label":"800xa_system","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.1","noFixRecorded":false,"fixedIn":null},{"text":"5.1:feature_pack_4","noFixRecorded":false,"fixedIn":null},{"text":"5.1:feature_pack_4_revision_d","noFixRecorded":false,"fixedIn":null},{"text":"5.1:revision_a","noFixRecorded":false,"fixedIn":null},{"text":"5.1:revision_b","noFixRecorded":false,"fixedIn":null},{"text":"5.1:revision_c","noFixRecorded":false,"fixedIn":null},{"text":"5.1:revision_d","noFixRecorded":false,"fixedIn":null},{"text":"5.1:revision_e","noFixRecorded":false,"fixedIn":null},{"text":"5.1:revision_e_feature_pack_4","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"6.0.1","noFixRecorded":false,"fixedIn":null},{"text":"6.0.3","noFixRecorded":false,"fixedIn":null},{"text":"6.0.3.3","noFixRecorded":false,"fixedIn":null},{"text":"6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.1 | 5.1:feature_pack_4 | 5.1:feature_pack_4_revision_d | 5.1:revision_a | 5.1:revision_b | 5.1:revision_c | 5.1:revision_d | 5.1:revision_e | 5.1:revision_e_feature_pack_4 | 6.0 | 6.0.1 | 6.0.3 | 6.0.3.3 | 6.1","eol":null,"hubHref":"/vendor/abb/800xa_system"},{"vendor":"abb","product":"abb  ability™ scadavantage","name":"ABB  Ability™ SCADAvantage","label":"abb  ability™ scadavantage","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.1, < unspecified","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, ≤ 5.6.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.1, < unspecified | ≥ unspecified, ≤ 5.6.5","eol":null,"hubHref":"/vendor/abb/abb__abilityTM_scadavantage"},{"vendor":"abb","product":"abb ability system 800xa","name":"ABB Ability System 800xA","label":"abb ability system 800xa","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.1","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.1 | 6.0 | 6.1","eol":null,"hubHref":"/vendor/abb/abb_ability_system_800xa"},{"vendor":"abb","product":"advabuild","name":"advabuild","label":"advabuild","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.7 SP1","noFixRecorded":false,"fixedIn":null},{"text":"3.7 SP2","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.7 SP1 | 3.7 SP2","eol":null,"hubHref":"/vendor/abb/advabuild"},{"vendor":"abb","product":"advant  ocs ac 100 ops server","name":"Advant  OCS AC 100 OPS Server","label":"advant  ocs ac 100 ops server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.1","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.1 | 6.0 | 6.1","eol":null,"hubHref":"/vendor/abb/advant__ocs_ac_100_ops_server"},{"vendor":"abb","product":"advant ocs control builder a","name":"Advant OCS Control Builder A","label":"advant ocs control builder a","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.3","noFixRecorded":false,"fixedIn":null},{"text":"1.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.3 | 1.4","eol":null,"hubHref":"/vendor/abb/advant_ocs_control_builder_a"},{"vendor":"abb","product":"central licensing system","name":"Central Licensing System","label":"central licensing system","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.1, < 5*","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.1, < 5*","eol":null,"hubHref":"/vendor/abb/central_licensing_system"},{"vendor":"abb","product":"compact_hmi","name":"compact hmi","label":"compact_hmi","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"5.1","noFixRecorded":false,"fixedIn":null},{"text":"5.1:feature_pack_4_revision_d","noFixRecorded":false,"fixedIn":null},{"text":"5.1:revision_b","noFixRecorded":false,"fixedIn":null},{"text":"5.1:revision_d","noFixRecorded":false,"fixedIn":null},{"text":"6.0.1-1","noFixRecorded":false,"fixedIn":null},{"text":"6.0.3-2","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0 | 5.1 | 5.1:feature_pack_4_revision_d | 5.1:revision_b | 5.1:revision_d | 6.0.1-1 | 6.0.3-2","eol":null,"hubHref":"/vendor/abb/compact_hmi"},{"vendor":"abb","product":"composer ctk","name":"Composer CTK","label":"composer ctk","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.1","noFixRecorded":false,"fixedIn":null},{"text":"6.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.1 | 6.2","eol":null,"hubHref":"/vendor/abb/composer_ctk"},{"vendor":"abb","product":"composer harmony","name":"Composer Harmony","label":"composer harmony","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.1","noFixRecorded":false,"fixedIn":null},{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.1 | 6.0 | 6.1","eol":null,"hubHref":"/vendor/abb/composer_harmony"},{"vendor":"abb","product":"composer melody","name":"Composer Melody","label":"composer melody","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"5.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6, ≤ 6.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"5.3 | ≥ 6, ≤ 6.3","eol":null,"hubHref":"/vendor/abb/composer_melody"},{"vendor":"abb","product":"control_builder_safe","name":"control builder safe","label":"control_builder_safe","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.0","noFixRecorded":false,"fixedIn":null},{"text":"1.1","noFixRecorded":false,"fixedIn":null},{"text":"2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.0 | 1.1 | 2.0","eol":null,"hubHref":"/vendor/abb/control_builder_safe"},{"vendor":"abb","product":"harmony opc server standalone","name":"Harmony OPC Server Standalone","label":"harmony opc server standalone","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"6.1","noFixRecorded":false,"fixedIn":null},{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0 | 6.1 | 7.0","eol":null,"hubHref":"/vendor/abb/harmony_opc_server_standalone"},{"vendor":"abb","product":"knowledge manager","name":"Knowledge Manager","label":"knowledge manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null},{"text":"9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0 | 9.0 | 9.1","eol":null,"hubHref":"/vendor/abb/knowledge_manager"},{"vendor":"abb","product":"manufacturing operations management","name":"Manufacturing Operations Management","label":"manufacturing operations management","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1812","noFixRecorded":false,"fixedIn":null},{"text":"1909","noFixRecorded":false,"fixedIn":null}],"versionsText":"1812 | 1909","eol":null,"hubHref":"/vendor/abb/manufacturing_operations_management"},{"vendor":"abb","product":"opc data link","name":"OPC Data Link","label":"opc data link","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.1","noFixRecorded":false,"fixedIn":null},{"text":"2.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.1 | 2.2","eol":null,"hubHref":"/vendor/abb/opc_data_link"},{"vendor":"abb","product":"opc server for mod 300 (non-800xa)","name":"OPC Server for Mod 300 (non-800xA)","label":"opc server for mod 300 (non-800xa)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.4","eol":null,"hubHref":"/vendor/abb/opc_server_for_mod_300_non-800xa"},{"vendor":"abb","product":"symphony plus s+ engineering","name":"Symphony Plus S+ Engineering","label":"symphony plus s+ engineering","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.1, ≤ 2.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.1, ≤ 2.2","eol":null,"hubHref":"/vendor/abb/symphony_plus_s_engineering"},{"vendor":"abb","product":"symphony_plus_s\\+_operations","name":"symphony plus s\\+ operations","label":"symphony_plus_s\\+_operations","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 3, ≤ 3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 3, ≤ 3.2","eol":null,"hubHref":"/vendor/abb/symphony_plus_s_operations"}],"affectedCount":19,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://search.abb.com/library/Download.aspx?DocumentID=2PAA121231&LanguageCode=en&DocumentPartId=&Action=Launch","label":"search.abb.com/library/…","hostname":"search.abb.com","tags":["Vendor Advisory"]},{"url":"https://search.abb.com/library/Download.aspx?DocumentID=2PAA121230&LanguageCode=en&DocumentPartId=&Action=Launch","label":"search.abb.com/library/…","hostname":"search.abb.com","tags":["Vendor Advisory"]},{"url":"https://search.abb.com/library/Download.aspx?DocumentID=3CCA2020-003309&LanguageCode=en&DocumentPartId=&Action=Launch","label":"search.abb.com/library/…","hostname":"search.abb.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-04-29T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T10:03:44.814Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T07:12:17.962Z","stale":false,"partial":false}}