CVE-2020-24679 Denial of Service attack on Symphony Plus
Attackers can crash the service or execute arbitrary code via crafted messages, impacting industrial control system availability and integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24679?
CVE-2020-24679 is a high-severity denial of service vulnerability in ABB Ability™ Symphony® Plus Historian, published on 22 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted.
Weakness: CWE-20
Which versions are affected by CVE-2020-24679?
It affects 2 products.
Products include Abb Symphony \+ Historian, Abb Symphony \+ Operations.
How do I fix CVE-2020-24679?
No fix has been published for CVE-2020-24679 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-24679 being exploited?
There is no known exploitation of CVE-2020-24679 in the wild and no public exploit code.
Other vulnerabilities in ABB Ability™ Symphony® Plus Historian
Sources
Also known as GHSA-j5q4-h79w-mh86.