CVE-2020-24679
📋 TL;DR
CVE-2020-24679 is a vulnerability in ABB's S+ Operations and S+ Historian services where specially crafted messages can cause denial of service or potentially arbitrary code execution. This affects industrial control systems using these ABB products, potentially allowing attackers to disrupt operations or gain control of affected systems.
💻 Affected Systems
- ABB S+ Operations
- ABB S+ Historian
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, operational disruption, and potential safety impacts in industrial environments.
Likely Case
Service crashes causing denial of service and operational downtime in affected industrial systems.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially only causing temporary service interruptions.
🎯 Exploit Status
Exploitation requires crafting specific messages to the service, but no authentication is needed if network access is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches available via vendor advisories
Vendor Advisory: https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
Restart Required: Yes
Instructions:
1. Download patches from ABB advisory links. 2. Apply patches following vendor instructions. 3. Restart affected services. 4. Verify patch application.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to S+ Operations and Historian services to only trusted systems
Firewall Rules
allImplement strict firewall rules to limit which systems can communicate with vulnerable services
🧯 If You Can't Patch
- Implement strict network segmentation and access controls
- Deploy intrusion detection systems to monitor for crafted message patterns
🔍 How to Verify
Check if Vulnerable:
Check if running affected ABB S+ Operations or Historian versions without patches appliedCheck Version:
Check product version through ABB management interfaces or Windows ServicesVerify Fix Applied:
Verify patch installation via vendor documentation and check service version after patching📡 Detection & Monitoring
Log Indicators:
- Service crash logs
- Unusual connection attempts to S+ services
- Error messages related to malformed messages
Network Indicators:
- Unusual traffic patterns to S+ service ports
- Crafted message patterns in network traffic
SIEM Query:
source="*S+*" AND (event_type="crash" OR message="*malformed*" OR message="*crafted*")🔗 References
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
- https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
