What is the CVSS score of CVE-2019-7225?

CVE-2019-7225 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.9%.

Is there a public PoC exploit available for CVE-2019-7225?

Yes, a public proof-of-concept exploit is available for CVE-2019-7225. Prioritise patching immediately. EPSS: 2.9%.

Cp620 Firmware CVE-2019-7225

HIGH

Use of Hard-coded Credentials (CWE-798)

2019-06-27 cve@mitre.org

Authentication Bypass Abb Cp620 Firmware Cp620 Web Firmware Cp630 Firmware Cp630 Web Firmware Cp635 Firmware Cp635 B Firmware Cp635 Web Firmware Pb610 Firmware Cp651 Web Firmware Cp661 Firmware Cp661 Web Firmware Cp665 Firmware Cp665 Web Firmware Cp676 Firmware Cp676 Web Firmware Cp651 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 27, 2019 - 17:15 nvd

HIGH 8.8

DescriptionNVD

The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are the idal123 password for the IdalMaster account, and the exor password for the exor account. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device. This affects ABB CP635 HMI, CP600 HMIClient, Panel Builder 600, IDAL FTP server, IDAL HTTP server, and multiple other HMI components.

AnalysisAI

The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are the idal123 password for the IdalMaster account, and the exor password for the exor account. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device. This affects ABB CP635 HMI, CP600 HMIClient, Panel Builder 600, IDAL FTP server, IDAL HTTP server, and multiple other HMI components. Affected products include: Abb Cp620 Firmware, Abb Cp620-Web Firmware, Abb Cp630 Firmware, Abb Cp630-Web Firmware, Abb Cp635 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.