CVE-2019-18250
In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication bypass, which may allow an attacker to remotely bypass authentication and extract credentials from the affected…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.68%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication bypass, which may allow an attacker to remotely bypass authentication and extract credentials from the affected device.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.68% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-288, CWE-287
- Affected
- abb/plant connect · abb/power generation information manager
- Source
- ics-cert@hq.dhs.gov
References
- https://www.us-cert.gov/ics/advisories/icsa-19-318-05Not Applicable, Permissions Required, Third Party Advisory, US Government Resource
- https://iotsecuritynews.com/abb-power-generation-information-manager-pgim-and-plant-connect/Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-318-05Not Applicable, Permissions Required, Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.