CVE-2022-1607 - Cross Site Scripting vulnerability in NE843 Pulsar Plus Controller

Back Back to CVE browser

HIGH

Cross Site Scripting vulnerability in NE843 Pulsar Plus Controller

Published Feb 24, 2023

8.8

HIGH

CVSS 3.1

EPSS 0.21%

Description

Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.

Affected products

Vendor ABB Product Infinity DC Power Plant Default
unaffected
- Version
  H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415
  Status
  affected
  Constraints
  -
Vendor ABB Product Pulsar Plus System Controller NE843 S Default
unaffected
- Version
  comcode 150042936
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ABB

Infinity DC Power Plant

unaffected

Version	Status	Constraints
H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415	affected	-

ABB

Pulsar Plus System Controller NE843 S

unaffected

Version	Status	Constraints
comcode 150042936	affected	-

Remediation

Vendor solution

A workaround is to use the controller’s Read/Write Enable/Disable feature for a network port (NET1,WRE=0). The controller can disable all writes over the network port. The factory default is to have the write capability enabled. However, some customers do not want settings to be remotely changed once systems are set. This feature, when set to Disable, will allow no changes to be accepted. Once set it can only be changed locally through the front panel. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”

Weaknesses (1)

CWE-352

CSRF

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-24896		Advisory
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch		Vendor Advisory