ABB PB610 Panel Builder 600

# ICS Advisory (ICSA-19-178-01) ## ABB PB610 Panel Builder 600 Original release date: June 27, 2019 [Print Document](javascript:window.print\(\);) [Tweet](https://twitter.com/share?url=https%3A%2F%2Fus- cert.cisa.gov%2Fics%2Fadvisories%2Ficsa-19-178-01) [Like Me](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fus- cert.cisa.gov%2Fics%2Fadvisories%2Ficsa-19-178-01) [Share](http://www.addthis.com/bookmark.php?url=https%3A%2F%2Fus- cert.cisa.gov%2Fics%2Fadvisories%2Ficsa-19-178-01) ### Legal Notice All information products included in [https://us-cert.gov/ics](/ics) are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://www.us- cert.gov/tlp/](/tlp/). * * * ## 1\. EXECUTIVE SUMMARY * **CVSS v3 8.8** * **ATTENTION:** Low skill level to exploit * **Vendor:** ABB * **Equipment:** PB610 Panel Builder 600 * **Vulnerabilities:** Use of Hard-coded Credentials, Improper Authentication, Relative Path Traversal, Improper Input Validation, Stack-based Buffer Overflow ## 2\. RISK EVALUATION An attacker who successfully exploits these vulnerabilities could prevent legitimate access to an affected system node, remotely cause an affected system node to stop, take control of an affected system node, or insert and run arbitrary code in an affected system node. ## 3\. TECHNICAL DETAILS ### 3.1 AFFECTED PRODUCTS The following versions of PB610 Panel Builder 600, an engineering tool for designing HMI applications and the runtime for control panels, which are used for the operation of automation systems, are affected: * PB610 Panel Builder 600, order code: 1SAP500900R0101, Versions 1.91 … 2.8.0.367 and prior. ### 3.2 VULNERABILITY OVERVIEW ### 3.2.1 [USE OF HARD-CODED CREDENTIALS CWE-798](https://cwe.mitre.org/data/definitions/798.html) The ABB CP635 HMI component implements hidden administrative accounts used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. [CVE-2019-7225](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-7225) has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ([AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)). ### 3.2.2 [IMPROPER AUTHENTICATION CWE-287](https://cwe.mitre.org/data/definitions/287.html) The IDAL HTTP server CGI interface contains a URL, which allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. [CVE-2019-7226](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-7226) has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ([AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)). ### 3.2.3 [RELATIVE PATH TRAVERSAL CWE-23](https://cwe.mitre.org/data/definitions/23.html) The IDAL FTP server fails to ensure directory change requests do not change to locations outside of the root FTP directory. An authenticated attacker can simply traverse outside the server root directory by changing the directory. [CVE-2019-7227](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-7227) has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is ([AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)). ### 3.2.4 [IMPROPER INPUT VALIDATION CWE-20](https://cwe.mitre.org/data/definitions/20.html) The IDAL HTTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server. [CVE-2019-7228](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-7228) has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ([AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)). ### 3.2.5 [IMPROPER INPUT VALIDATION CWE-20](https://cwe.mitre.org/data/definitions/20.html) The IDAL FTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server. [CVE-2019-7230](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-7230) has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ([AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)). ### 3.2.6 [STACK-BASED BUFFER OVERFLOW CWE-121](https://cwe.mitre.org/data/definitions/121.html) The IDAL HTTP server is vulnerable to a stack-based buffer overflow when a large host header is sent in a HTTP request. The host header value overflows a buffer and can overwrite the Structured Exception Handler (SEH) address with a large chunk of data. [CVE-2019-7232](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-7232) has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is ([AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)). ### 3.2.7 [STACK-BASED BUFFER OVERFLOW CWE-121](https://cwe.mitre.org/data/definitions/121.html) The IDAL FTP server is vulnerable to a buffer overflow when a large string is sent by an authenticated attacker. This overflow is handled, but terminates the process. [CVE-2019-7231](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-7231) has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ([AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)). ### 3.3 BACKGROUND * **CRITICAL INFRASTRUCTURE SECTORS:** Chemical, Critical Manufacturing, Dams, Energy, Food and Agriculture, Water and Wastewater * **COUNTRIES/AREAS DEPLOYED:** Worldwide * **COMPANY HEADQUARTERS LOCATION:** Switzerland ### 3.4 RESEARCHER Xen1thLabs, a Darkmatter Company, United Arab Emirates, and Abu Dhabi reported these vulnerabilities to ABB. ## 4\. MITIGATIONS The problems are corrected in the following product versions: [PB610 Panel Builder 600 v2.8.0.424](http://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A4167&LanguageCode=de&LanguageCode=en&LanguageCode=es&LanguageCode=fr&LanguageCode=zh&DocumentPartId=&Action=Launch). [New version of BSP (board support package) UN31 v2.31](http://search.abb.com/library/Download.aspx?DocumentID=BSPCP600UN31V231&LanguageCode=en&DocumentPartId=&Action=Launch). [New version of BSP (board support package) UN30 v2.31](http://search.abb.com/library/Download.aspx?DocumentID=BSPCP600UN30V231&LanguageCode=en&DocumentPartId=&Action=Launch). ABB recommends users apply the update of the PB610 applications on CP600 control panels at the earliest convenience. If an update of the devices is not possible. ABB recommends users restrict network access to the devices to only trusted parties/devices. To prevent an unauthorized login via a remote client, leave the "Force Remote Login" option of the security settings checked (default setting). In addition, set new users and passwords in the user's settings for remote clients to "use different user and password." ABB's recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include : * Restrict physical access to process control systems to authorized personnel, * Do not have direct connections to the Internet, * Separate from other networks by means of a firewall system with a minimal number of exposed ports, * Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. * Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. More information on ABB's recommended practices can be found in the following document: [3BSE032547, Whitepaper - Security for Industrial Automation and Control Systems](https://library.e.abb.com/public/b1f29a78bc9979d7c12577ec00177633/3BSE032547_B_en_Security_for_Industrial_Automation_and_Control_Systems.pdf) For additional information and support please contact the local ABB service organization. For contact information, see: <https://new.abb.com/contact- centers>. Information about ABB's cybersecurity program and capabilities can be found at: <http://www.abb.com/cybersecurity>. For more information see ABB's security advisory [3ADR010377](https://search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch). NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should: * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices. NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. NCCIC also provides a section for [control systems security recommended practices](https://ics-cert.us-cert.gov/content/recommended-practices) on the ICS-CERT web page. Several recommended practices are available for reading and download, including [Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies](https://www.us- cert.gov/sites/default/files/recommended_practices/NCCIC_ICS- CERT_Defense_in_Depth_2016_S508C.pdf). Additional mitigation guidance and recommended practices are publicly available on the [ICS-CERT website](https://ics-cert.us-cert.gov/) in the Technical Information Paper, [ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies](https://ics-cert.us-cert.gov/tips/ICS- TIP-12-146-01B). Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents. No known public exploits specifically target these vulnerabilities. If a control panel with a PB610 HMI application is connected to a network, an attacker who has network access to an affected system node could exploit these vulnerabilities. If the control panel is not connected to a network, an attacker would need to have physical access to an affected system node to exploit these vulnerabilities.