title: ABB Relion REX640 Insufficient file access control
description: Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an attack against the user database file and try to take control of an affected system node.
problem types: CWE-732 Incorrect Permission Assignment for Critical Resource
affected:
{
product: REX640 PCL1
vendor: ABB
versions:
lessThanOrEqual: 1.0.7, status: affected, version: unspecified, versionType: custom
}
{
product: REX640 PCL2
vendor: ABB
versions:
lessThan: 1.1.4, status: affected, version: unspecified, versionType: custom
}
{
product: REX640 PCL3
vendor: ABB
versions:
lessThan: 1.2.1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
workarounds: Although these workarounds will not correct the underlying vulnerability, they can help blocking known
attack vectors.
• Limit the HTTP(s) and FTP(S) to a local network by a firewall
• Use a next generation (OSI layer 7) firewall for blocking the traffic to the userdb.xml file
• Disable remote WHMI and FTP(S) and use local HMI only