Freelance controllers AC 700F: Numeric Range Comparison Without Minimum Check
CVE-2023-0425 is a high-severity numeric range comparison without minimum check vulnerability in Freelance controllers AC 700F from ABB, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Freelance controllers AC 700F versions: 9.0;0 through V9.2 SP2; Freelance 2013 and earlier; Freelance 2013SP1 and earlier, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.47% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Ac700f Firmware to 9.2.0 or a later version.
- Read the advisory on search.abb.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| ABB | Freelance controllers AC 700F | 9.0;0 through V9.2 SP2; Freelance 2013 and earlier; Freelance 2013SP1 and earlier; Freelance 2016 and earlier; Freelance 2016SP1 and earlier; Freelance 2019 and earlier; Freelance 2019 SP1 and earlier; Freelance 2019 SP1 FP1 and earlier; and 8 more ranges | Not stated |
| ABB | Freelance controllers AC 900F | Freelance 2013 and earlier; Freelance 2013SP1 and earlier; Freelance 2016 and earlier; Freelance 2016SP1 and earlier; Freelance 2019 and earlier; Freelance 2019 SP1 and earlier; Freelance 2019 SP1 FP1 and earlier; freelance2013 and earlier; and 6 more ranges | Not stated |
| ABB | Ac700f Firmware | 9.0.0 up to, but not including, 9.2.0; 9.2.0 | 9.2.0 |
| ABB | Freelance 2013 | Not specified in the record | Not stated |
| ABB | Freelance 2016 | Not specified in the record | Not stated |
| ABB | Freelance 2019 | Not specified in the record | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 8.6 | High | CNA (ch.abb.com) |
| CVSS 3.1 | 7.5 | High | NVD |
Official description
ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these vulnerabilities could cause the product to stop or make the product inaccessible. Numeric Range Comparison Without Minimum Check vulnerability in ABB Freelance controllers AC 700F (Controller modules), ABB Freelance controllers AC 900F (controller modules).This issue affects: Freelance controllers AC 700F: from 9.0;0 through V9.2 SP2, through Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1; Freelance controllers AC 900F: Freelance 2013, through Freelance 2013SP1, through Freelance 2016, through Freelance 2016SP1, through Freelance 2019, through Freelance 2019 SP1, through Freelance 2019 SP1 FP1.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Numeric Range Comparison Without Minimum Check
The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
How developers prevent this class of flaw
- If the number to be used is always expected to be positive, change the variable type from signed to unsigned or size_t.
- If the number to be used could have a negative value based on the specification (thus requiring a signed value), but the number should only be positive to preserve code correctness, then include a check to ensure that the value is positive.
More Numeric Range Comparison Without Minimum Check vulnerabilities (CWE-839)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Other vulnerabilities in Freelance controllers AC 700F
- 7.5 High severity
Recent Numeric Range Comparison Without Minimum Check vulnerabilities
- 7.5 High severity
Spotted an error? Tell us.