CVE-2021-22283 MMS File Transfer Vulnerability impact on Distribution Automation products
Improper initialization in ABB Relion protection relays allows communication channel manipulation, impacting distribution automation security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22283?
CVE-2021-22283 is a medium-severity vulnerability in ABB Merging Unit- SMU615, published on 28 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Initialization vulnerability in ABB Relion protection relays - 611 series, ABB Relion protection relays - 615 series IEC 4.0 FP1, ABB Relion protection relays - 615 series CN 4.0 FP1, ABB Relion protection relays - 615 series IEC 5.0, ABB Relion protection relays - 615 series IEC 5.0 FP1, ABB Relion protection relays - 620 series IEC/CN 2.0, ABB Relion protection relays - 620 series IEC/CN 2.0 FP1, ABB Relion protection relays - REX640 PCL1, ABB Relion protection relays - REX640 PCL2, ABB Relion protection relays - REX640 PCL3, ABB Relion protection relays - RER615, ABB Remote Monitoring and Control - REC615, ABB Merging Unit- SMU615 allows Communication Channel Manipulation.This issue affects Relion protection relays - 611 series: from 1.0.0 before 2.0.3; Relion protection relays - 615 series IEC 4.0 FP1: from 4.1.0 before 4.1.9; Relion protection relays - 615 series CN 4.0 FP1: from 4.1.0 before 4.1.8; Relion protection relays - 615 series IEC 5.0: from 5.0.0 before 5.0.12; Relion protection relays - 615 series IEC 5.0 FP1: from 5.1.0 before 5.1.20; Relion protection relays - 620 series IEC/CN 2.0: from 2.0.0 before 2.0.11; Relion protection relays - 620 series IEC/CN 2.0 FP1: from 2.1.0 before 2.1.15; Relion protection relays - REX640 PCL1: from 1.0.0 before 1.0.8; Relion protection relays - REX640 PCL2: from 1.1.0 before 1.1.4; Relion protection relays - REX640 PCL3: from 1.2.0 before 1.2.1; Relion protection relays - RER615: from 2.0.0 before 2.0.3; Remote Monitoring and Control - REC615: from 1.0.0 before 2.0.3; Merging Unit- SMU615: from 1.0.0 before 1.0.2.
Weakness: CWE-665
Which versions are affected by CVE-2021-22283?
It affects 19 products.
Products include Abb Evd4 Firmware, Abb Rec615 Firmware, Abb Red615 Iec Firmware, Abb Ref615 Ansi Firmware, Abb Ref615 Iec Firmware, Abb Ref615r Firmware and 13 more.
How do I fix CVE-2021-22283?
No fix has been published for CVE-2021-22283 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22283 being exploited?
There is no known exploitation of CVE-2021-22283 in the wild and no public exploit code.
Sources
Also known as GHSA-wxvf-mm56-j2pq.