ABB System 800xA Information Manager Remote Code Execution
Priority MEDIUM 41CWE-489Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code.
Why it matters now
EPSS 0.01711 77th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ABB | System 800xA Information Manager | 5 – 5.1; 6.0 – 6.0.3.2; 6.1 and later | — | No fix listed | CNA |
- System 800xA Information Manager VendorABB Affected 5 – 5.1; 6.0 – 6.0.3.2; 6.1 and later Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8477
- 2026-10-03 Alias added: GHSA-h92g-5h7r-qg2w
References
Sources
- CVE-2020-8477 · CVE Program
- CVE-2020-8477 · NVD
- FIRST EPSS
- GHSA-h92g-5h7r-qg2w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences