Vulnerability · Published Apr 22, 2020 · Assigned by ABB
CVE-2020-8477ABB System 800xA Information Manager Remote Code Execution
High 8.8
In plain English
A high-severity cross-site scripting in System 800xA Information Manager from ABB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.7%top 22.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ABB | System 800xA Information Manager | 5 – through 5.16.0 – through 6.0.3.26.1 – before 6.1* |
Weakness: CWE-79, CWE-489 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H