VULNERABILITY INTELLIGENCE

CVE-2019-18998

CVSS score7.1 HIGH

EPSS probability0.78%

CISA KEVNot currently listed

Published2020-02-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Description

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.

Weakness classification

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key

Primary references

cybersecurity@ch.abb.com — Vendor Advisory
cybersecurity@ch.abb.com — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource