Vulnerability Description
The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Abb | Symphony \+ Historian | 3.0 |
| Abb | Symphony \+ Operations | 1.1 |
Related Weaknesses (CWE)
References
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=MitigationVendor Advisory
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=MitigationVendor Advisory
FAQ
What is CVE-2020-24683?
CVE-2020-24683 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as...
How severe is CVE-2020-24683?
CVE-2020-24683 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-24683?
Check the references section above for vendor advisories and patch information. Affected products include: Abb Symphony \+ Historian, Abb Symphony \+ Operations.