title: Certificate verification vulnerability  in Update Manager of PCM600 Engineering Tool
description: A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on computer which has PCM600 installed.
problem types: CWE-295 Improper Certificate Validation
affected:
{
product: PCM600
vendor: ABB
versions:
lessThan: unspecified, status: affected, version: 2.7, versionType: custom
lessThanOrEqual: 2.10, status: affected, version: unspecified, versionType: custom
}
{
product: PCM600 Update Manager
vendor: ABB
versions:
status: affected, version: 2.1
status: affected, version: 2.1.0.4
status: affected, version: 2.2
status: affected, version: 2.2.0.1
status: affected, version: 2.2.0.2
status: affected, version: 2.2.0.23
status: affected, version: 2.3.0.60
status: affected, version: 2.4.20041.1
status: affected, version: 2.4.20119.2
}
{
product: PCM600
vendor: Hitachi Energy
versions:
lessThan: unspecified, status: affected, version: 2.7, versionType: custom
lessThanOrEqual: 2.10, status: affected, version: unspecified, versionType: custom
}
{
product: PCM600 Update Manager
vendor: Hitachi Energy
versions:
status: affected, version: 2.1
status: affected, version: 2.1.0.4
status: affected, version: 2.2
status: affected, version: 2.2.0.1
status: affected, version: 2.2.0.2
status: affected, version: 2.2.0.23
status: affected, version: 2.3.0.60
status: affected, version: 2.4.20041.1
status: affected, version: 2.4.20119.2
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Install latest PCM600 Update Manager version 2.4.21218.1 or newer.