ABB PB610 Panel Builder 600 Use of Hard-Coded Credentials (CVE-2019-7225)

high Tenable OT Security Plugin ID 500947

Synopsis

The remote OT asset is affected by a vulnerability.

Description

The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool Panel Builder 600 to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are the idal123 password for the IdalMaster account, and the exor password for the exor account. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device. This affects ABB CP635 HMI, CP600 HMIClient, Panel Builder 600, IDAL FTP server, IDAL HTTP server, and multiple other HMI components.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

The problems are corrected in the following product versions:

PB610 Panel Builder 600 v2.8.0.424.

New version of BSP (board support package) UN31 v2.31.

New version of BSP (board support package) UN30 v2.31.

ABB recommends users apply the update of the PB610 applications on CP600 control panels at the earliest convenience.

If an update of the devices is not possible. ABB recommends users restrict network access to the devices to only trusted parties/devices.

To prevent an unauthorized login via a remote client, leave the “Force Remote Login” option of the security settings checked (default setting). In addition, set new users and passwords in the user’s settings for remote clients to “use different user and password.”

ABB’s recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include :

- Restrict physical access to process control systems to authorized personnel,
- Do not have direct connections to the Internet,
- Separate from other networks by means of a firewall system with a minimal number of exposed ports,
- Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails.
- Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.

More information on ABB’s recommended practices can be found in the following document:

Plugin Details

Severity: High

ID: 500947

Version: 1.8

Type: remote

Family: Tenable.ot

Published: 3/29/2023

Updated: 3/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.5

Vector: CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-7225

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:abb:cp620-web_firmware, cpe:/o:abb:cp620_firmware, cpe:/o:abb:cp630-web_firmware, cpe:/o:abb:cp630_firmware, cpe:/o:abb:cp635-b_firmware, cpe:/o:abb:cp635-web_firmware, cpe:/o:abb:cp635_firmware, cpe:/o:abb:cp651-web_firmware, cpe:/o:abb:cp651_firmware, cpe:/o:abb:cp661-web_firmware, cpe:/o:abb:cp661_firmware, cpe:/o:abb:cp665-web_firmware, cpe:/o:abb:cp665_firmware, cpe:/o:abb:cp676-web_firmware, cpe:/o:abb:cp676_firmware

Required KB Items: Tenable.ot/ABB

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/27/2019

Vulnerability Publication Date: 6/27/2019

Reference Information

CVE: CVE-2019-7225

CWE: 798

Detections

Analytics