Access control flaw in ABB VSN300 WiFi Logger Card
Priority LOW 32CWE-264Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Privilege escalation
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264 and CWE-269.
Summary
A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3 and prior. The web application does not properly restrict privileges of the Guest account. A malicious user may be able to gain access to configuration information that should be restricted.
Why it matters now
EPSS 0.01459 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ABB VSN300 WiFi Logger Card | ABB VSN300 WiFi Logger Card | — | No fix listed | CNA |
- ABB VSN300 WiFi Logger Card Vendor— Affected ABB VSN300 WiFi Logger Card Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:abb:vsn300_firmware:*:*:*:*:*:*:*:* | up to 1.8.15 | Vulnerable | ABB |
| cpe:2.3:h:abb:vsn300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:vsn300_for_react_firmware:2.1.3:*:*:*:*:*:*:* | 2.1.3 | Vulnerable | ABB |
| cpe:2.3:h:abb:vsn300_for_react:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
- cpe:2.3:o:abb:vsn300_firmware:*:*:*:*:*:*:*:* Versions up to 1.8.15 Vulnerable ·ABB
- cpe:2.3:h:abb:vsn300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:vsn300_for_react_firmware:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·ABB
- cpe:2.3:h:abb:vsn300_for_react:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7916
- 2026-10-03 Alias added: GHSA-86g9-p235-r7ff
References
More ABB Vsn300 Firmware vulnerabilities
- TI-2017-05529 Improper authentication in ABB VSN300 WiFi Logger Card CVSS 3.0HIGH 7.5
Sources
- CVE-2017-7916 · CVE Program
- CVE-2017-7916 · NVD
- FIRST EPSS
- GHSA-86g9-p235-r7ff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences