CVE-2022-26080 | ByteOS Network

Vulnerability Details :

CVE-2022-26080

Assigner-ABB

Assigner Org ID-2b718523-d88f-4f37-9bbd-300c20644bf9

Published At-16 Mar, 2023 | 12:53

Updated At-26 Feb, 2025 | 15:04

Easily guessable session ID's in NE843 Pulsar Plus Controller

Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:ABB

Assigner Org ID:2b718523-d88f-4f37-9bbd-300c20644bf9

Published At:16 Mar, 2023 | 12:53

Updated At:26 Feb, 2025 | 15:04

▼CVE Numbering Authority (CNA)

Easily guessable session ID's in NE843 Pulsar Plus Controller

Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.

Affected Products

Vendor

Product

Pulsar Plus System Controller NE843_S

Default Status

unaffected

Versions

Affected

comcode 150042936

Vendor

Product

Infinity DC Power Plant

Default Status

unaffected

Versions

Affected

H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415

Problem Types

Type	CWE ID	Description
CWE	CWE-330	CWE-330 Use of Insufficiently Random Values

Type: CWE

CWE ID: CWE-330

Description: CWE-330 Use of Insufficiently Random Values

Metrics

Version	Base score	Base severity	Vector
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Credits

finder

We acknowledge the help of Vlad Ionescu of Facebook Red Team X for reports on the vulnerabilities described in this document.

References

Hyperlink	Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.256117643.1223066510.1678942947-1879524908.1677751217	N/A

Hyperlink: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.256117643.1223066510.1678942947-1879524908.1677751217

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.256117643.1223066510.1678942947-1879524908.1677751217	x_transferred

Hyperlink: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.256117643.1223066510.1678942947-1879524908.1677751217

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:cybersecurity@ch.abb.com

Published At:16 Mar, 2023 | 13:15

Updated At:07 Nov, 2023 | 03:44

Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Secondary	3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Type: Primary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

CPE Matches

>>h5692448_g104>>-

cpe:2.3:h:abb:h5692448_g104:-:*:*:*:*:*:*:*

>>h5692448_g104_firmware>>-

cpe:2.3:o:abb:h5692448_g104_firmware:-:*:*:*:*:*:*:*

>>h5692448_g842>>-

cpe:2.3:h:abb:h5692448_g842:-:*:*:*:*:*:*:*

>>h5692448_g842_firmware>>-

cpe:2.3:o:abb:h5692448_g842_firmware:-:*:*:*:*:*:*:*

>>h5692448_g224l>>-

cpe:2.3:h:abb:h5692448_g224l:-:*:*:*:*:*:*:*

>>h5692448_g224l_firmware>>-

cpe:2.3:o:abb:h5692448_g224l_firmware:-:*:*:*:*:*:*:*

>>h5692448_g630-4>>-

cpe:2.3:h:abb:h5692448_g630-4:-:*:*:*:*:*:*:*

>>h5692448_g630-4_firmware>>-

cpe:2.3:o:abb:h5692448_g630-4_firmware:-:*:*:*:*:*:*:*

>>h5692448_g451c\(2\)>>-

cpe:2.3:h:abb:h5692448_g451c\(2\):-:*:*:*:*:*:*:*

>>h5692448_g451c\(2\)_firmware>>-

cpe:2.3:o:abb:h5692448_g451c\(2\)_firmware:-:*:*:*:*:*:*:*

>>h5692448_g461\(2\)>>-

cpe:2.3:h:abb:h5692448_g461\(2\):-:*:*:*:*:*:*:*

>>h5692448_g461\(2\)_firmware>>-

cpe:2.3:o:abb:h5692448_g461\(2\)_firmware:-:*:*:*:*:*:*:*

>>ne843_s_firmware>>-

cpe:2.3:o:abb:ne843_s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:abb:ne843_s:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-330	Primary	nvd@nist.gov
CWE-330	Secondary	cybersecurity@ch.abb.com

CWE ID: CWE-330

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-330

Type: Secondary

Source: cybersecurity@ch.abb.com

References

Hyperlink	Source	Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.256117643.1223066510.1678942947-1879524908.1677751217	cybersecurity@ch.abb.com	Vendor Advisory

Hyperlink: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.256117643.1223066510.1678942947-1879524908.1677751217

Source: cybersecurity@ch.abb.com

Resource:

Vendor Advisory