CVE-2019-5620

published 2020-04-29

CVE-2019-5620: ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.

Priority P1 81 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
abb	microscada_pro_sys600	—	—
hitachienergy	microscada_pro_sys600	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename wserver.exe↗

• → Monitor for unauthenticated EXECUTE operation requests targeting the wserver.exe component on ABB MicroSCADA SYS600 9.3 systems. ↗
• → Alert on presence or execution of wserver.exe in ABB MicroSCADA environments; the component is disabled by default but enabled when a project uses the SCIL function WORKSTATION_CALL. ↗
• → Exploit targets Windows XP SP3 and Windows 7 SP1 hosts running ABB MicroSCADA Pro SYS600 9.3; scope network monitoring to these OS/version combinations in OT environments. ↗

• · The vulnerable wserver.exe component is disabled by default; exploitation is only possible when a project has explicitly enabled it via the SCIL WORKSTATION_CALL function, limiting the exposed attack surface. ↗
• · The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), meaning no credentials are required to trigger remote code execution via EXECUTE operations. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306