CVE-2020-24675
📋 TL;DR
CVE-2020-24675 is an authentication bypass vulnerability in ABB's S+ Operations and S+ History software that allows unauthenticated attackers to inject values and write to controlled industrial processes. This affects systems running vulnerable versions of these ABB industrial control system products. The CVSS 9.8 score indicates critical severity due to the potential for remote code execution and process manipulation.
💻 Affected Systems
- ABB S+ Operations
- ABB S+ History
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to physical damage, production shutdown, safety system manipulation, or environmental harm through unauthorized process control.
Likely Case
Unauthorized data injection into industrial processes causing operational disruption, data integrity issues, or limited process manipulation.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to vulnerable systems.
🎯 Exploit Status
CWE-287 indicates improper authentication, making exploitation straightforward once vulnerability is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches available via ABB security advisories
Vendor Advisory: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
Restart Required: Yes
Instructions:
1. Download patches from ABB security advisories 2. Apply patches to affected S+ Operations and S+ History servers 3. Restart affected services/systems 4. Verify patch application
🔧 Temporary Workarounds
Network Segmentation
allIsolate S+ Operations and S+ History servers from untrusted networks
Access Control Lists
allImplement strict firewall rules to limit access to vulnerable servers
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy intrusion detection systems monitoring for unusual process control commands
🔍 How to Verify
Check if Vulnerable:
Check system version against ABB security advisories and verify if patches have been appliedCheck Version:
Check within S+ Operations/S+ History application interface or consult ABB documentationVerify Fix Applied:
Verify patch installation via system logs and version checks, then test authentication requirements📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to Operations History server
- Unexpected process control commands
- Authentication bypass attempts
Network Indicators:
- Unusual traffic to S+ Operations/History ports from unauthorized sources
- Process control commands from unexpected IPs
SIEM Query:
source_ip NOT IN (authorized_ips) AND dest_port IN (splus_ports) AND protocol=tcp🔗 References
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
