Detections
Analytics
ABB M2M Gateway Arbitrary Code Execution in embedded ClamAV (CVE-2023-20032)
critical Tenable OT Security Plugin ID 503245
Synopsis
The remote OT asset is affected by a vulnerability.Description
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog [https://blog.clamav.net/].This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
Refer to the vendor advisory.See Also
https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-08
Plugin Details
Severity: Critical
ID: 503245
Version: 1.1
Type: remote
Family: Tenable.ot
Published: 5/27/2025
Updated: 5/27/2025
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/o:abb:sw_firmware, cpe:/o:abb:arm600_firmware
Required KB Items: Tenable.ot/ABB
Exploit Ease: No known exploits are available
Patch Publication Date: 3/1/2023
Vulnerability Publication Date: 3/1/2023
Reference Information
CVE: CVE-2023-20032