title: SECURITY - OPC Server for AC 800M - Remote Code Execution Vulnerability
description: Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running the AC800M OPC Server.
problem types: CWE-732 Incorrect Permission Assignment for Critical Resource
affected:
{
product: 800xA, Control Software for AC 800M OPC Server for AC 800M
vendor: ABB
versions:
lessThanOrEqual: 5.1.0-x, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 5.1.1-x, status: affected, version: unspecified, versionType: custom
status: affected, version: 6.0.0-1
status: affected, version: 6.0.0-2
status: affected, version: 6.0.0-3
}
{
product: Control Builder Safe, version 1.x OPC Server for AC 800M
vendor: ABB
versions:
status: affected, version: 5.1.1-1
}
{
product: Control Builder Safe, version 2.0 OPC Server for AC 800M
vendor: ABB
versions:
status: affected, version: 6.0.0-1
}
{
product: Compact Product Suite - Control and I/O OPC Server for AC 800M
vendor: ABB
versions:
lessThanOrEqual: 5.1.0-x, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 5.1.1-x, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 6.0.0-x, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
]
solutions: Customers on version 5.1 or older are recommended to upgrade to a supported version that is not affected by this issue such as version 6.1 or later.