title: Malformed Packet Handling
description:
ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may
be used by several Symphony Plus products (e.g., S+ Operations, S+ Engineering and S+ Analyst)
This issue affects Symphony Plus S+ Operations: from 3..0;0 through 3.3 SP1 RU4, from 2.1;0 through 2.1 SP2 RU3, from 2.0;0 through 2.0 SP6 TC6; Symphony Plus S+ Engineering: from 2.1 through 2.3 RU3; Symphony Plus S+ Analyst: from 7.0.0.0 through 7.2.0.2.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: Symphony Plus S+ Operations
vendor: ABB
versions:
lessThanOrEqual: 3.3 SP1 RU4, status: affected, version: 3..0;0, versionType: custom
lessThanOrEqual: 2.1 SP2 RU3, status: affected, version: 2.1;0, versionType: custom
lessThanOrEqual: 2.0 SP6 TC6, status: affected, version: 2.0;0, versionType: custom
}
{
defaultStatus: unaffected
product: Symphony Plus S+ Engineering
vendor: ABB
versions:
lessThanOrEqual: 2.3 RU3, status: affected, version: 2.1, versionType: custom
}
{
defaultStatus: unaffected
product: Symphony Plus S+ Analyst
vendor: ABB
versions:
lessThanOrEqual: 7.2.0.2, status: affected, version: 7.0.0.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL