ABB CP635 HMI Use of Hard-Coded Credentials (CVE-2019-7225)

high Tenable OT Security Plugin ID 500947

Synopsis

The remote OT asset is affected by a vulnerability.

Description

The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool Panel Builder 600 to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are the idal123 password for the IdalMaster account, and the exor password for the exor account. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device. This affects ABB CP635 HMI, CP600 HMIClient, Panel Builder 600, IDAL FTP server, IDAL HTTP server, and multiple other HMI components.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

ABB recommends users apply the BSP update on affected CP600 control panels at their earliest convenience.

- New version of PB610 Panel Builder 600 v2.8.0.424, which is provided via Automation Builder 2.2 SP2.
- New version of BSP (board support package) UN31 v2.31.

Please see ABB cybersecurity advisory document number 3ADR010376 for more information about this vulnerability, and two other security issues and their mitigations.

Plugin Details

Severity: High

ID: 500947

Version: 1.9

Type: remote

Family: Tenable.ot

Published: 3/29/2023

Updated: 4/25/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.5

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-7225

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:abb:cp620-web_firmware, cpe:/o:abb:cp620_firmware, cpe:/o:abb:cp630-web_firmware, cpe:/o:abb:cp630_firmware, cpe:/o:abb:cp635-b_firmware, cpe:/o:abb:cp635-web_firmware, cpe:/o:abb:cp635_firmware, cpe:/o:abb:cp651-web_firmware, cpe:/o:abb:cp651_firmware, cpe:/o:abb:cp661-web_firmware, cpe:/o:abb:cp661_firmware, cpe:/o:abb:cp665-web_firmware, cpe:/o:abb:cp665_firmware, cpe:/o:abb:cp676-web_firmware, cpe:/o:abb:cp676_firmware

Required KB Items: Tenable.ot/ABB

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/27/2019

Vulnerability Publication Date: 6/27/2019

Reference Information

CVE: CVE-2019-7225

CWE: 798

Detections

Analytics