title:  Code Execution through overwriting project file on zenon engineering studio system
description:
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted
programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts.
This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.
problem types: CWE-276 Incorrect Default Permissions
affected:
{
defaultStatus: unaffected
product: ABB Ability™ zenon
vendor: ABB
versions:
lessThanOrEqual: 11 build 106404, status: affected, version: 11 build , versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds:
ABB recommends the following workarounds. Although these workarounds will not correct the underlying vulnerability, they block the known attack vectors.
• For CVE-2023-3323, Recommended practices include that process control systems are physically protected,
have no direct connections to the Internet, and are separated from other networks by
means of a firewall system that has a minimal number of ports exposed.  Remove the default directory permissions for ‘Everyone’ on the service grid, ABB utilities, and zenon_Projects directories and provide access only to specific users that are
expected to access zenon.  Install the IIoT services, which is, the Service grid component on a separate system.  Secure the ZEE600 related executable files in ‘C:\ProgramData\ABB\ABBUtilities’ directory by removing the group named “Everyone”.  Ensure the group name “Everyone” should be removed from the following directory.
‘C:\ProgramData\ABB’.  Secure zenon_Projects directory by managing the access permissions. The project directory should have access only for the user group (Excluding administrator) which has
the users to use zenon projects. Consider the following example:
Example: A user group named ‘zenonOwnersGroup’ to be created and it is the only
group that has write access to the zenon_ Projects directory. If the system has 2 users
such as test1(Part of zenonOwnersGroup ) and test2 (not in zenonOwnersGroup ). The
project directory (C:\Users\Public\Documents\zenon_Projects) should have write access only for the zenonOwnersGroup and for no one else. Now, test1 should have write
access the zenon_Project directory and test2 should not.