CVE:CVE-2019-7225
CNNVD:CNNVD-201906-894
ABB CP620等都是瑞士ABB公司的一款人机界面触控面板。
多款ABB产品中存在信任管理问题漏洞。攻击者可借助硬编码凭证利用该漏洞对HMI配置文件进行读写操作并重置设备。以下产品及版本受到影响：使用1.76及之前版本固件的ABB CP620；使用1.76及之前版本固件的ABB CP620-Web；使用1.76及之前版本固件的ABB CP630；使用1.76及之前版本固件的ABB CP630-Web；使用1.76及之前版本固件的ABB CP635；使用1.76及之前版本固件的ABB CP635-B；使用1.76及之前版本固件的ABB CP635-Web；使用1.91版本至2.8.0.3674版本固件的ABB PB610；使用1.76及之前版本固件的ABB CP651-Web；使用1.76及之前版本固件的ABB CP661；使用1.76及之前版本固件的ABB CP661-Web；使用1.76及之前版本固件的ABB CP665-Web；使用1.76及之前版本固件的ABB CP665；使用1.76及之前版本固件的ABB CP676-Web；使用1.76及之前版本固件的ABB CP676；使用1.76及之前版本固件的ABB CP651。
solution:Upgrade abb cp620_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp620-web_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp630_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp630-web_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp635_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp635-b_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp635-web_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb pb610_firmware to a higher version than 2.8.0.3674,and avoid the version [1.91,2.8.0.3674]; Upgrade abb cp651-web_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp661_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp661-web_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp665_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp665-web_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp676_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp676-web_firmware to a higher version than 1.76,and avoid the version (,1.76]; Upgrade abb cp651_firmware to a higher version than 1.76,and avoid the version (,1.76]