ABB CP400 Panel Builder TextEditor 2.0
Plan Patch7ICS-CERT ICSA-19-017-02Jan 17, 2019
Attack VectorLocal
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
A vulnerability in ABB CP400PB Panel Builder TextEditor versions 2.0.7.05 and earlier allows improper input validation. Successful exploitation may allow arbitrary code execution and denial-of-service conditions within the Text Editor application. The vulnerability is not remotely exploitable; it requires local access and user interaction to open a maliciously crafted Panel Builder file. High skill level is needed to exploit. No known public exploits currently exist.
What this means
What could happen
An attacker with local access to a Panel Builder workstation could execute arbitrary code within the application, potentially corrupting control system project files or disrupting engineering work on CP405/CP408 control panels.
Who's at risk
Engineering and automation teams at water utilities and electric utilities who use ABB CP400PB Panel Builder to design and maintain control logic for CP405 and CP408 control panels. Anyone responsible for managing these workstations should ensure they are updated.
How it could be exploited
An attacker must have local access to a workstation running Panel Builder TextEditor 2.0.7.05 or earlier. The vulnerability requires user interaction—the attacker would need to craft a malicious Panel Builder file or project and trick an engineer into opening it. The application would then execute arbitrary code during file processing.
Prerequisites
- Local access to a workstation running CP400PB Panel Builder TextEditor version 2.0.7.05 or earlier
- User must open a maliciously crafted Panel Builder file or project
- No special credentials or elevated privileges required on the workstation
Low complexity attack requiredUser interaction needed (social engineering vector)Default configurations vulnerableFile-based attack delivery
Exploitability
Low exploit probability (EPSS 0.3%)
Affected products (1)
ProductAffected VersionsFix Status
CP400PB Panel Builder for CP405 and CP408:≤ 2.0.7.052.1.7.21
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDTrain engineering staff to verify the source and legitimacy of Panel Builder files before opening, and scan all received files with up-to-date antivirus software
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate CP400PB Panel Builder TextEditor to version 2.1.7.21 or later
Long-term hardening
0/2HARDENINGImplement network segmentation to isolate engineering workstations running Panel Builder from the business network and the Internet
HARDENINGEnforce the principle of least privilege on engineering workstations—run Panel Builder with standard user accounts, not administrator accounts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/ceb77520-a552-474d-b8be-eb7855ff5f68