« Volver al listado

CVE-2020-8472

Estado: ModificadaAlta (7.8)—

Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

ABB — Base SoftwareABB — Control Builder MABB — MMS ServerABB — OPC Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8472",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 9.5,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@ch.abb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@ch.abb.com",
      "affectedData": [
        {
          "vendor": "ABB",
          "product": "OPC Server for AC 800M",
          "versions": [
            {
              "status": "affected",
              "version": "6.0 and earlier"
            }
          ]
        },
        {
          "vendor": "ABB",
          "product": "Control Builder M Professional",
          "versions": [
            {
              "status": "affected",
              "version": "6.1 and earlier"
            }
          ]
        },
        {
          "vendor": "ABB",
          "product": "MMS Server for AC 800M",
          "versions": [
            {
              "status": "affected",
              "version": "6.1 and earlier"
            }
          ]
        },
        {
          "vendor": "ABB",
          "product": "Base Software for SoftControl",
          "versions": [
            {
              "status": "affected",
              "version": "6.1 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-29T00:15:12.140",
  "references": [
    {
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106&LanguageCode=en&DocumentPartId=&Action=Launch",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@ch.abb.com"
    },
    {
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=2PAA121106&LanguageCode=en&DocumentPartId=&Action=Launch",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@ch.abb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications."
    },
    {
      "lang": "es",
      "value": "Los permisos de carpeta insuficientes usados por las funciones del sistema en los productos de ABB System 800xA, OPCServer para AC800M (versiones 6.0 y anteriores) y Control Builder M Professional, MMSServer para AC800M, Base Software para SoftControl (versiones 6.1 y anteriores), permiten a usuarios pocos privilegiados leer, modificar, añadir y eliminar archivos de sistema y de aplicaciones. Un atacante autenticado que explote con éxito las vulnerabilidades podría escalar sus privilegios, causar que las funcionalidades del sistema se detengan y corromper las aplicaciones de los usuarios."
    }
  ],
  "lastModified": "2026-06-17T03:26:25.953",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:abb:control_builder_m:*:*:*:*:professional:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF3F9C56-7F8F-49CB-980A-692B5AC5E83E",
              "versionEndIncluding": "6.1"
            },
            {
              "criteria": "cpe:2.3:a:abb:mms_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3583C160-2C48-4CFC-A7C5-7FD5A92DA870",
              "versionEndIncluding": "6.1"
            },
            {
              "criteria": "cpe:2.3:a:abb:opc_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "834273F4-44F8-4A1C-B89F-54C5F587F186",
              "versionEndIncluding": "6.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:abb:ac800m:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "18F5825D-A99A-4109-A08F-114C7D6D3FC3"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:abb:base_software:*:*:*:*:*:softcontrol:*:*",
              "vulnerable": true,
              "matchCriteriaId": "844BB8F4-1A3A-4D2F-A9A3-603AB80F3C49",
              "versionEndIncluding": "6.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cybersecurity@ch.abb.com"
}