CVE-2019-18996CWE-424

ABB PB610 HMIStudio accepts malicious DLL file in an application

High · published December 18, 2019

CVSS v3.1
7.1
EPSS
0%
Percentile
33.1
In the wild
Unconfirmed
What it is

Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s context.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00400 · 33.1th percentile
Weakness
CWE-424 · Improper Protection of Alternate Path
Published
2019-12-18T20:24Z
EPSS history
Timeline
  • 18 DEC 20:24Z
    ABB PB610 HMIStudio accepts malicious DLL file in an application
    cvelistv5