ABB Ability Zenon

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2020-7921, CVE-2020-7923, CVE-2020-7924, CVE-2020-7925, CVE-2020-7928. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or compromise data. The following versions of ABB Ability Zenon are affected:

IIoT services with MongoDB (4.2) installed on ABB Ability Zenon vers:all/* 

CVSS Vendor Equipment Vulnerabilities

v3 7.8 ABB ABB Ability Zenon Improper Handling of Length Parameter Inconsistency, Improper Neutralization of Null Byte or NUL Character, Collapse of Data into Unsafe Value, Undefined Behavior for Input to API, Incorrect Regular Expression, Uncaught Exception, Reachable Assertion, Allocation of Resources Without Limits or Throttling, Out-of-bounds Write, Improper Output Neutralization for Logs, Improper Certificate Validation, Execution with Unnecessary Privileges

Background

Critical Infrastructure Sectors: Chemical, Communications, Critical Manufacturing, Dams, Energy, Healthcare and Public Health, Information Technology, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland

Vulnerabilities

Expand All +

CVE-2025-14847

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2020-7921, CVE-2020-7923, CVE-2020-7924, CVE-2020-7925, CVE-2020-7928): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.cisa.gov/news-events/ics-advisories/icsa-26-218-01
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.