What is the CVSS score of CVE-2019-7229?

CVE-2019-7229 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Is there a public PoC exploit available for CVE-2019-7229?

Yes, a public proof-of-concept exploit is available for CVE-2019-7229. Prioritise patching immediately. EPSS: 1.1%.

Is there a patch available for CVE-2019-7229?

Yes, a patch is available for CVE-2019-7229. Update the affected software to the latest version immediately.

Board Support Package Un31 CVE-2019-7229

HIGH

Download of Code Without Integrity Check (CWE-494)

2019-06-24 cve@mitre.org

Abb Information Disclosure Board Support Package Un31 Cp620 Firmware Cp620 Web Firmware Cp630 Firmware Cp630 Web Firmware Cp635 Firmware Cp635 B Firmware Cp635 Web Firmware

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 24, 2019 - 18:15 nvd

HIGH 8.3

DescriptionNVD

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of encryption or authenticity checks against the new firmware HMI software binary files.

AnalysisAI

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via. Rated high severity (CVSS 8.3), this vulnerability is no authentication required. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-494. The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of encryption or authenticity checks against the new firmware HMI software binary files. Affected products include: Abb Board Support Package Un31, Abb Cp620 Firmware, Abb Cp620-Web Firmware, Abb Cp630 Firmware, Abb Cp630-Web Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.