ABB System 800xA Inter process communication vulnerability
Priority LOW 24CWE-264Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-264.
Summary
Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Software for SoftControl (all published versions) enables an attacker authenticated on the local system to inject data, affecting the online view of runtime data shown in Control Builder.
Why it matters now
EPSS 0.0034 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ABB | OPC Server for AC 800M | all versions | — | No fix listed | CNA |
| ABB | MMS Server for AC 800M | all versions | — | No fix listed | CNA |
| ABB | Base Software for SoftControl | all versions | — | No fix listed | CNA |
- OPC Server for AC 800M VendorABB Affected all versions Fixed in — No fix listed CNA
- MMS Server for AC 800M VendorABB Affected all versions Fixed in — No fix listed CNA
- Base Software for SoftControl VendorABB Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:abb:mms_server:*:*:*:*:*:*:*:* | all versions | Vulnerable | ABB |
| cpe:2.3:a:abb:opc_server:*:*:*:*:*:*:*:* | all versions | Vulnerable | ABB |
| cpe:2.3:h:abb:ac800m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:a:abb:base_software:*:*:*:*:*:softcontrol:*:* | all versions | Vulnerable | ABB |
- cpe:2.3:a:abb:mms_server:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·ABB
- cpe:2.3:a:abb:opc_server:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·ABB
- cpe:2.3:h:abb:ac800m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:a:abb:base_software:*:*:*:*:*:softcontrol:*:* Versions all versions Vulnerable ·ABB
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8478
- 2026-10-03 Alias added: GHSA-hjpp-qfqw-hpvq
References
More ABB Base Software vulnerabilities
- TI-2020-15139 ABB Base Software for SoftControl Remote Code Execution vulnerability CVSS 3.1CRITICAL 9.8
- TI-2021-05255 AC 800M MMS - Denial of Service vulnerability in MMS communication CVSS 3.1HIGH 7.5
- TI-2020-06799 ABB System 800xA Weak File Permissions - different products CVSS 3.1HIGH 7.8
Sources
- CVE-2020-8478 · CVE Program
- CVE-2020-8478 · NVD
- FIRST EPSS
- GHSA-hjpp-qfqw-hpvq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences