Use of hard-coded credentials in ABB products - CVE-2019-7225
Published: July 4, 2019
Vulnerability identifier: #VU19010
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2019-7225
CWE-ID: CWE-798
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vendor: ABB
Affected software:
BSP UN31
BSP UN30
PB610 Panel Builder 600
BSP UN31
BSP UN30
PB610 Panel Builder 600
Detailed vulnerability description
The vulnerability allows an attacker to gain full access to vulnerable system.
The vulnerability exists due to presence of hard-coded credentials in code, which are IdalMaster:idal123 and exor:exor. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
How to mitigate CVE-2019-7225
Install updates from vendor's website.