SB2019070406 - Backdoor account in ABB CP635 HMI

Description

This security bulletin contains information about 1 vulnerability.

1) Use of hard-coded credentials (CVE-ID: CVE-2019-7225)

CWE-ID: CWE-798 - Use of Hard-coded Credentials

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

The vulnerability allows an attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in code, which are IdalMaster:idal123 and exor:exor. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://www.us-cert.gov/ics/advisories/icsa-19-178-01
• https://search-ext.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch