Read the docs
TI-2020-06807 Aliases CVE-2020-8481GHSA-w8qc-fmpq-5gmp

ABB Central Licensing System - Information disclosure

Priority MEDIUM 46CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, confidential data is written in an unprotected file. An attacker who successfully exploited this vulnerability could take full control of the computer.

Why it matters now

EPSS 0.01855 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ABBCentral Licensing System5.1 and later—No fix listedCNA
ABBABB Ability System 800xA5.1; 6.0; 6.1—No fix listedCNA
ABBCompact HMI5.1; 6.0—No fix listedCNA
ABBControl Builder Safe1.0; 1.1; 2.0—No fix listedCNA
ABBSymphony Plus S+ Operations3 – 3.2—No fix listedCNA
ABBSymphony Plus S+ Engineering1.1 – 2.2—No fix listedCNA
ABBComposer Harmony5.1; 6.0; 6.1—No fix listedCNA
ABBComposer Melody5.3; 6 – 6.3—No fix listedCNA
ABBHarmony OPC Server Standalone6.0; 6.1; 7.0—No fix listedCNA
ABBAdvant OCS Control Builder A1.3; 1.4—No fix listedCNA
ABBComposer CTK6.1; 6.2—No fix listedCNA
ABBAdvaBuild3.7 SP1; 3.7 SP2—No fix listedCNA
ABBOPC Server for Mod 300 (non-800xA)1.4—No fix listedCNA
ABBOPC Data Link2.1; 2.2—No fix listedCNA
ABBKnowledge Manager8.0; 9.0; 9.1—No fix listedCNA
ABBManufacturing Operations Management1812; 1909—No fix listedCNA
ABBAdvant OCS AC 100 OPS Server5.1; 6.0; 6.1—No fix listedCNA
  • Central Licensing System VendorABB Affected 5.1 and later Fixed in — No fix listed CNA
  • ABB Ability System 800xA VendorABB Affected 5.1; 6.0; 6.1 Fixed in — No fix listed CNA
  • Compact HMI VendorABB Affected 5.1; 6.0 Fixed in — No fix listed CNA
  • Control Builder Safe VendorABB Affected 1.0; 1.1; 2.0 Fixed in — No fix listed CNA
  • Symphony Plus S+ Operations VendorABB Affected 3 – 3.2 Fixed in — No fix listed CNA
  • Symphony Plus S+ Engineering VendorABB Affected 1.1 – 2.2 Fixed in — No fix listed CNA
  • Composer Harmony VendorABB Affected 5.1; 6.0; 6.1 Fixed in — No fix listed CNA
  • Composer Melody VendorABB Affected 5.3; 6 – 6.3 Fixed in — No fix listed CNA
  • Harmony OPC Server Standalone VendorABB Affected 6.0; 6.1; 7.0 Fixed in — No fix listed CNA
  • Advant OCS Control Builder A VendorABB Affected 1.3; 1.4 Fixed in — No fix listed CNA
  • Composer CTK VendorABB Affected 6.1; 6.2 Fixed in — No fix listed CNA
  • AdvaBuild VendorABB Affected 3.7 SP1; 3.7 SP2 Fixed in — No fix listed CNA
  • OPC Server for Mod 300 (non-800xA) VendorABB Affected 1.4 Fixed in — No fix listed CNA
  • OPC Data Link VendorABB Affected 2.1; 2.2 Fixed in — No fix listed CNA
  • Knowledge Manager VendorABB Affected 8.0; 9.0; 9.1 Fixed in — No fix listed CNA
  • Manufacturing Operations Management VendorABB Affected 1812; 1909 Fixed in — No fix listed CNA
  • Advant OCS AC 100 OPS Server VendorABB Affected 5.1; 6.0; 6.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:abb:800xa_system:5.1:-:*:*:*:*:*:*5.1VulnerableABB
  • cpe:2.3:a:abb:800xa_system:5.1:-:*:*:*:*:*:* Versions 5.1 Vulnerable ·ABB

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ABB Central Licensing System 5*

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2020-06806 ABB Central Licensing System - XML External Entity InjectionPriority MEDIUM 46
    • TI-2020-06803 ABB Central Licensing System - Elevation of Privilege VulnerabilityPriority LOW 36
    • TI-2020-06802 ABB Central Licensing System - Denial of Service VulnerabilityPriority LOW 35
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8481
  2. 2026-10-03 Alias added: GHSA-w8qc-fmpq-5gmp

References

Advisory 2

  • TI-2020-06806 ABB Central Licensing System - XML External Entity Injection CVSS 3.1CRITICAL 9.8
  • TI-2020-06803 ABB Central Licensing System - Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.5
  • TI-2020-06802 ABB Central Licensing System - Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2020-06798 ABB Central Licensing System - Weak File Permissions CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences