title: Cross Site Scripting vulnerability in NE843 Pulsar Plus Controller
description: Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
defaultStatus: unaffected
product: Pulsar Plus System Controller NE843_S
vendor: ABB
versions:
status: affected, version: comcode 150042936
}
{
defaultStatus: unaffected
product: Infinity DC Power Plant
vendor: ABB
versions:
status: affected, version: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds:
A workaround is to use the controller’s Read/Write Enable/Disable feature for a network port
(NET1,WRE=0). The controller can disable all writes over the network port. The factory default is to have
the write capability enabled. However, some customers do not want settings to be remotely changed
once systems are set. This feature, when set to Disable, will allow no changes to be accepted. Once set it
can only be changed locally through the front panel.
ABB has tested the following workarounds. Although these workarounds will not correct the underlying
vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is
identified below as “Impact of workaround”