CVE-2019-7229
High
Description
The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of encryption or authenticity checks against the new firmware HMI software binary files.
SeverityHigh
CVSS8.3
Exploit probability—
ProductAbb Cp635 Firmware
PublishedJun 24, 2019
First seenJun 24, 2019
How to fix
Update
- abb cp635_firmware2.8.0.424 or later
- abb board_support_package_un312.31 or later
- abb cp620_firmware2.8.0.424 or later
- abb cp620-web_firmware2.8.0.424 or later
- abb cp630_firmware2.0.8.424 or later
- abb cp630-web_firmware2.8.0.424 or later
- abb cp635-b_firmware2.8.0.424 or later
- abb cp635-web_firmware2.8.0.424 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| abb cp635_firmware | v < 2.8.0.424 | 2.8.0.424 |
| abb board_support_package_un31 | v < 2.31 | 2.31 |
| abb cp620_firmware | v < 2.8.0.424 | 2.8.0.424 |
| abb cp620-web_firmware | v < 2.8.0.424 | 2.8.0.424 |
| abb cp630_firmware | v < 2.0.8.424 | 2.0.8.424 |
| abb cp630-web_firmware | v < 2.8.0.424 | 2.8.0.424 |
| abb cp635-b_firmware | v < 2.8.0.424 | 2.8.0.424 |
| abb cp635-web_firmware | v < 2.8.0.424 | 2.8.0.424 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.