Read the docs
TI-2020-15146 Aliases CVE-2020-24679GHSA-j5q4-h79w-mh86

Denial of Service attack on Symphony Plus

Priority MEDIUM 46CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted.

Why it matters now

EPSS 0.01886 79th percentileScored 2026-11-07
Fix Fixed ABB Ability™ Symphony® Plus Operations (ABB): 3.3 Service Pack 1, 2.1 SP2 Rollup 2, 2.2ABB Ability™ Symphony® Plus Historian (ABB): 3.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ABBABB Ability™ Symphony® Plus Operationsbefore 3.3 Service Pack 1; before 2.1 SP2 Rollup 2; before 2.23.3 Service Pack 1, 2.1 SP2 Rollup 2, 2.2Patch availableCNA
ABBABB Ability™ Symphony® Plus Historianbefore 3.23.2Patch availableCNA
  • ABB Ability™ Symphony® Plus Operations VendorABB Affected before 3.3 Service Pack 1; before 2.1 SP2 Rollup 2; before 2.2 Fixed in 3.3 Service Pack 1, 2.1 SP2 Rollup 2, 2.2 Patch available CNA
  • ABB Ability™ Symphony® Plus Historian VendorABB Affected before 3.2 Fixed in 3.2 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:abb:symphony_\+_historian:3.0:*:*:*:*:*:*:*3.0VulnerableABB
cpe:2.3:a:abb:symphony_\+_historian:3.1:*:*:*:*:*:*:*3.1VulnerableABB
cpe:2.3:a:abb:symphony_\+_operations:1.1:*:*:*:*:*:*:*1.1VulnerableABB
cpe:2.3:a:abb:symphony_\+_operations:2.0:*:*:*:*:*:*:*2.0VulnerableABB
cpe:2.3:a:abb:symphony_\+_operations:2.1:sp1:*:*:*:*:*:*2.1 sp1VulnerableABB
cpe:2.3:a:abb:symphony_\+_operations:2.1:sp2:*:*:*:*:*:*2.1 sp2VulnerableABB
cpe:2.3:a:abb:symphony_\+_operations:3.0:*:*:*:*:*:*:*3.0VulnerableABB
cpe:2.3:a:abb:symphony_\+_operations:3.1:*:*:*:*:*:*:*3.1VulnerableABB
cpe:2.3:a:abb:symphony_\+_operations:3.2:*:*:*:*:*:*:*3.2VulnerableABB
cpe:2.3:a:abb:symphony_\+_operations:3.3:*:*:*:*:*:*:*3.3VulnerableABB
  • cpe:2.3:a:abb:symphony_\+_historian:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·ABB
  • cpe:2.3:a:abb:symphony_\+_historian:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·ABB
  • cpe:2.3:a:abb:symphony_\+_operations:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·ABB
  • cpe:2.3:a:abb:symphony_\+_operations:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·ABB
  • cpe:2.3:a:abb:symphony_\+_operations:2.1:sp1:*:*:*:*:*:* Versions 2.1 sp1 Vulnerable ·ABB
  • cpe:2.3:a:abb:symphony_\+_operations:2.1:sp2:*:*:*:*:*:* Versions 2.1 sp2 Vulnerable ·ABB
  • cpe:2.3:a:abb:symphony_\+_operations:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·ABB
  • cpe:2.3:a:abb:symphony_\+_operations:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·ABB
  • cpe:2.3:a:abb:symphony_\+_operations:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·ABB
  • cpe:2.3:a:abb:symphony_\+_operations:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·ABB

Remediation

  • Fix · CNA ABB Ability™ Symphony® Plus Operations (ABB) Fixed in 3.3 Service Pack 1, 2.1 SP2 Rollup 2, 2.2
  • Fix · CNA ABB Ability™ Symphony® Plus Historian (ABB) Fixed in 3.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ABB Ability™ Symphony® Plus Historian, ABB Ability™ Symphony® Plus Operations 2.1 SP2 Rollup 2, 2.2 and 2 more versions

    8 records Highest priority Priority MEDIUM 6 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2020-15142 Weak Authentication in Symphony PlusPriority MEDIUM 44
    • TI-2020-15141 Improper Authorization in Symphony PlusPriority MEDIUM 44
    • TI-2020-15140 SQL Injection in Symphony PlusPriority MEDIUM 44
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-24679
  2. 2026-10-03 Alias added: GHSA-j5q4-h79w-mh86

References

Advisory 2

  • TI-2020-15150 Authentication Bypass in Symphony Plus CVSS 3.1CRITICAL 9.8
  • TI-2020-15142 Weak Authentication in Symphony Plus CVSS 3.1CRITICAL 9.8
  • TI-2020-15141 Improper Authorization in Symphony Plus CVSS 3.1HIGH 8.8
  • TI-2020-15140 SQL Injection in Symphony Plus CVSS 3.1CRITICAL 9.8
  • TI-2020-15145 Potential Privilege Escalation in Symphony Plus CVSS 3.1HIGH 8.8
  • TI-2020-15144 Insecure Web Service in Symphony Plus CVSS 3.1HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences