title: ABB Central Licensing System - Weak File Permissions
description: For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, weak file permissions allow an authenticated attacker to block the license handling, escalate his/her privileges and execute arbitrary code.
problem types: CWE-275 Permission Issues
affected:
{
product: Central Licensing System
vendor: ABB
versions:
lessThan: 5*, status: affected, version: 5.1, versionType: custom
}
{
product: ABB Ability System 800xA
vendor: ABB
versions:
status: affected, version: 5.1
status: affected, version: 6.0
status: affected, version: 6.1
}
{
product: Compact HMI
vendor: ABB
versions:
status: affected, version: 5.1
status: affected, version: 6.0
}
{
product: Control Builder Safe
vendor: ABB
versions:
status: affected, version: 1.0
status: affected, version: 1.1
status: affected, version: 2.0
}
{
product: Symphony Plus S+ Operations
vendor: ABB
versions:
lessThanOrEqual: 3.2, status: affected, version: 3, versionType: custom
}
{
product: Symphony Plus S+ Engineering
vendor: ABB
versions:
lessThanOrEqual: 2.2, status: affected, version: 1.1, versionType: custom
}
{
product: Composer Harmony
vendor: ABB
versions:
status: affected, version: 5.1
status: affected, version: 6.0
status: affected, version: 6.1
}
{
product: Composer Melody
vendor: ABB
versions:
status: affected, version: 5.3
lessThanOrEqual: 6.3, status: affected, version: 6, versionType: custom
}
{
product: Harmony OPC Server Standalone
vendor: ABB
versions:
status: affected, version: 6.0
status: affected, version: 6.1
status: affected, version: 7.0
}
{
product: Advant OCS Control Builder A
vendor: ABB
versions:
status: affected, version: 1.3
status: affected, version: 1.4
}
{
product: Composer CTK
vendor: ABB
versions:
status: affected, version: 6.1
status: affected, version: 6.2
}
{
product: AdvaBuild
vendor: ABB
versions:
status: affected, version: 3.7 SP1
status: affected, version: 3.7 SP2
}
{
product: OPC Server for Mod 300 (non-800xA)
vendor: ABB
versions:
status: affected, version: 1.4
}
{
product: OPC Data Link
vendor: ABB
versions:
status: affected, version: 2.1
status: affected, version: 2.2
}
{
product: Knowledge Manager
vendor: ABB
versions:
status: affected, version: 8.0
status: affected, version: 9.0
status: affected, version: 9.1
}
{
product: Manufacturing Operations Management
vendor: ABB
versions:
status: affected, version: 1812
status: affected, version: 1909
}
{
product: Advant  OCS AC 100 OPS Server
vendor: ABB
versions:
status: affected, version: 5.1
status: affected, version: 6.0
status: affected, version: 6.1
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]