ABB System 800xA Weak File Permissions - different products
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ABB | OPC Server for AC 800M | up to 6.0 | — | No fix listed | CNA |
| ABB | Control Builder M Professional | up to 6.1 | — | No fix listed | CNA |
| ABB | MMS Server for AC 800M | up to 6.1 | — | No fix listed | CNA |
| ABB | Base Software for SoftControl | up to 6.1 | — | No fix listed | CNA |
- OPC Server for AC 800M VendorABB Affected up to 6.0 Fixed in — No fix listed CNA
- Control Builder M Professional VendorABB Affected up to 6.1 Fixed in — No fix listed CNA
- MMS Server for AC 800M VendorABB Affected up to 6.1 Fixed in — No fix listed CNA
- Base Software for SoftControl VendorABB Affected up to 6.1 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:abb:control_builder_m:*:*:*:*:professional:*:*:* | up to 6.1 | Vulnerable | ABB |
| cpe:2.3:a:abb:mms_server:*:*:*:*:*:*:*:* | up to 6.1 | Vulnerable | ABB |
| cpe:2.3:a:abb:opc_server:*:*:*:*:*:*:*:* | up to 6.0 | Vulnerable | ABB |
| cpe:2.3:h:abb:ac800m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:a:abb:base_software:*:*:*:*:*:softcontrol:*:* | up to 6.1 | Vulnerable | ABB |
- cpe:2.3:a:abb:control_builder_m:*:*:*:*:professional:*:*:* Versions up to 6.1 Vulnerable ·ABB
- cpe:2.3:a:abb:mms_server:*:*:*:*:*:*:*:* Versions up to 6.1 Vulnerable ·ABB
- cpe:2.3:a:abb:opc_server:*:*:*:*:*:*:*:* Versions up to 6.0 Vulnerable ·ABB
- cpe:2.3:h:abb:ac800m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:a:abb:base_software:*:*:*:*:*:softcontrol:*:* Versions up to 6.1 Vulnerable ·ABB
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8472
- 2026-10-03 Alias added: GHSA-8mqc-2jhr-7v56
References
More ABB Base Software vulnerabilities
- TI-2020-15139 ABB Base Software for SoftControl Remote Code Execution vulnerability CVSS 3.1CRITICAL 9.8
- TI-2021-05255 AC 800M MMS - Denial of Service vulnerability in MMS communication CVSS 3.1HIGH 7.5
- TI-2020-06805 ABB System 800xA Inter process communication vulnerability CVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-8472 · CVE Program
- CVE-2020-8472 · NVD
- FIRST EPSS
- GHSA-8mqc-2jhr-7v56 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences