title: ABB Central Licensing System - Information disclosure
description: For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer.
problem types: CWE-200 Information Exposure
affected:
{
product: Central Licensing System
vendor: ABB
versions:
lessThan: 5*, status: affected, version: 5.1, versionType: custom
}
{
product: ABB Ability System 800xA
vendor: ABB
versions:
status: affected, version: 5.1
status: affected, version: 6.0
status: affected, version: 6.1
}
{
product: Compact HMI
vendor: ABB
versions:
status: affected, version: 5.1
status: affected, version: 6.0
}
{
product: Control Builder Safe
vendor: ABB
versions:
status: affected, version: 1.0
status: affected, version: 1.1
status: affected, version: 2.0
}
{
product: Symphony Plus S+ Operations
vendor: ABB
versions:
lessThanOrEqual: 3.2, status: affected, version: 3, versionType: custom
}
{
product: Symphony Plus S+ Engineering
vendor: ABB
versions:
lessThanOrEqual: 2.2, status: affected, version: 1.1, versionType: custom
}
{
product: Composer Harmony
vendor: ABB
versions:
status: affected, version: 5.1
status: affected, version: 6.0
status: affected, version: 6.1
}
{
product: Composer Melody
vendor: ABB
versions:
status: affected, version: 5.3
lessThanOrEqual: 6.3, status: affected, version: 6, versionType: custom
}
{
product: Harmony OPC Server Standalone
vendor: ABB
versions:
status: affected, version: 6.0
status: affected, version: 6.1
status: affected, version: 7.0
}
{
product: Advant OCS Control Builder A
vendor: ABB
versions:
status: affected, version: 1.3
status: affected, version: 1.4
}
{
product: Composer CTK
vendor: ABB
versions:
status: affected, version: 6.1
status: affected, version: 6.2
}
{
product: AdvaBuild
vendor: ABB
versions:
status: affected, version: 3.7 SP1
status: affected, version: 3.7 SP2
}
{
product: OPC Server for Mod 300 (non-800xA)
vendor: ABB
versions:
status: affected, version: 1.4
}
{
product: OPC Data Link
vendor: ABB
versions:
status: affected, version: 2.1
status: affected, version: 2.2
}
{
product: Knowledge Manager
vendor: ABB
versions:
status: affected, version: 8.0
status: affected, version: 9.0
status: affected, version: 9.1
}
{
product: Manufacturing Operations Management
vendor: ABB
versions:
status: affected, version: 1812
status: affected, version: 1909
}
{
product: Advant  OCS AC 100 OPS Server
vendor: ABB
versions:
status: affected, version: 5.1
status: affected, version: 6.0
status: affected, version: 6.1
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]