Vulnerability Details : CVE-2019-5620
Public exploit exists!
ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.
Products affected by CVE-2019-5620
- cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-5620
8.77%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2019-5620
-
ABB MicroSCADA wserver.exe Remote Code Execution
Disclosure Date: 2013-04-05First seen: 2020-04-26exploit/windows/scada/abb_wserver_execThis module exploits a remote stack buffer overflow vulnerability in ABB MicroSCADA. The issue is due to the handling of unauthenticated EXECUTE operations on the wserver.exe component, which allows arbitrary commands. The component is disabled by default, but requir
CVSS scores for CVE-2019-5620
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2019-5620
-
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.Assigned by:
- cve@rapid7.con (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2019-5620
-
https://www.rapid7.com/db/modules/exploit/windows/scada/abb_wserver_exec
ABB MicroSCADA wserver.exe Remote Code ExecutionThird Party Advisory
Jump to