Critical Vulnerability Discovered in ABB GATE E1 & E2 Pluto Gateway devices
Nelson Berg, an Applied Risk researcher, has discovered multiple vulnerabilities in the ABB GATE E1 and ABB GATE E2 Pluto Gateway units. The first vulnerability concerns a Missing Authentication for Critical Functions vulnerability, and the second a Persistent Cross-Site Scripting vulnerability.
The ABB GATE E1/E2 Pluto Gateway units provide two-way communication between a Pluto Safety PLC and other field buses. The devices are commonly used in a range of industries such as Oil & Gas, Manufacturing, Chemicals and Power, amongst many other industrial sectors.
Exploitation of these vulnerabilities may allow an attacker to compromise the availability of the device or compromise the web browser of an administrator visiting the web-portal.
The missing authentication flaw has been given a CVSSv3 (Common Vulnerability Scoring System) of 9.8 (critical), while the cross-site scripting vulnerability has received a CVSSv3 of 7.1 (high).
Applied Risk has worked alongside the vendor in the responsible disclosure process.
To read an overview of the advisory, please visit here
ABB Measurement & Analytics
- 08706006122
- enquiries.mp.uk@gb.abb.com
- http://www.abb.com
- Howard Road Eaton Socon Saint Neots PE19 8EU GB
Where we supply to
UK Ireland, Europe, Africa, Asia, Australia, South America, North America
Industries we supply to
Automation, Chemicals, Consultants, Energy and Power, Food and Beverage, Glass Ceramics Cement, Metals and Minerals, OEM, Paper and Pulp, Pharmaceutical Cosmetics Toiletries, Plastics and Rubber, Recycling, Textiles, Water and Wastewater
-
Water for life: ABB’s measurement technology trailblazes water solution
-
My Measurement Assistant’s latest features 2022
-
Discover the advantages digital diaphragm seal solutions have over traditional remote seal solutions
