ABB PCM600 Credential Protection Vulnerabilities (CVE-2016-4511/4516/4524/4527)

ABB PCM600 Vulnerabilities Overview ABB identified one instance of password hash with insufficient computational effort and three vulnerabilities related to insufficiently protected credentials in its PCM600 product. These vulnerabilities were discovered by Ilya Karpov from Positive Technologies. ABB has released a new version to address these issues. Affected Products PCM600 up to and including Version 2.6 Impact Exploitation of these vulnerabilities could enable an attacker to modify the main application or gain unauthorized access to PCM600 or connected devices. The actual impact on individual organizations depends on their operational environment, system architecture, and specific product implementation. Vulnerability Characterization Vulnerability Overview 1. Use of Password Hash with Insufficient Computational Effort (CVE-2016-4511NVD) - The main application password in the ACTConfig configuration file is hashed using a weak hashing algorithm. - CVSS v3 base score: 2.8 2. Insufficiently Protected Credentials (CVE-2016-4516NVD) - The main application password is stored insecurely after being modified. - CVSS v3 base score: 2.8 3. Insufficiently Protected Credentials (CVE-2016-4524NVD) - OPC Server IEC61850 authentication passwords are temporarily stored without adequate protection. - CVSS v3 base score: 4.6 4. Insufficiently Protected Credentials (CVE-2016-4527NVD) - PCM600 authentication credentials are stored without sufficient security measures. - CVSS v3 base score: 2.8 Exploitability These vulnerabilities cannot be exploited remotely and require physical or local user interaction. Existence of Exploit There are no known public exploits specifically targeting these vulnerabilities. Difficulty An attacker with minimal technical skill could exploit these vulnerabilities. Mitigation ABB recommends upgrading to PCM600 Version 2.7. Additional security best practices include: Physically securing control systems Avoiding direct internet connectivity Isolating control systems from other networks Refraining from using control systems for web browsing or email Scanning portable devices before connecting them to the network For remote access, use secure methods such as VPNs. Organizations should also adhere to internal procedures for reporting suspected malicious activity to ICS-CERT.

Goal Reached Thanks to every supporter — we hit 100%!

ABB PCM600 Credential Protection Vulnerabilities (CVE-2016-4511/4516/4524/4527)