CVE-2024-0335 Malformed Packet Handling
Attackers can exploit malformed packet handling in the VPNI feature to access or modify data in ABB Symphony Plus products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0335?
CVE-2024-0335 is a high-severity path traversal vulnerability in ABB Symphony Plus S+ Analyst, published on 3 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products (e.g., S+ Operations, S+ Engineering and S+ Analyst)
This issue affects Symphony Plus S+ Operations: from 3..0;0 through 3.3 SP1 RU4, from 2.1;0 through 2.1 SP2 RU3, from 2.0;0 through 2.0 SP6 TC6; Symphony Plus S+ Engineering: from 2.1 through 2.3 RU3; Symphony Plus S+ Analyst: from 7.0.0.0 through 7.2.0.2.
Weakness: CWE-23
Which versions are affected by CVE-2024-0335?
How do I fix CVE-2024-0335?
No fix has been published for CVE-2024-0335 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-0335 being exploited?
There is no known exploitation of CVE-2024-0335 in the wild and no public exploit code.
Sources
Also known as GHSA-f982-vxqp-wp2r.