CVE-2021-22278 : Security Advisory and Response

A certificate validation vulnerability in PCM600 Update Manager allows attackers to install unwanted software packages on computers with PCM600 installed.

Understanding CVE-2021-22278

This CVE involves a certificate verification vulnerability in the Update Manager of PCM600 Engineering Tool.

What is CVE-2021-22278?

The vulnerability allows attackers to install unwanted software packages on a computer with PCM600 installed.

The Impact of CVE-2021-22278

With a CVSS base score of 6.7, this vulnerability has a medium severity impact. Attackers can exploit this flaw to compromise the confidentiality, integrity, and availability of affected systems.

Technical Details of CVE-2021-22278

This vulnerability has high attack complexity and requires low privileges from the attacker. User interaction is required for successful exploit. The attack vector is local.

Vulnerability Description

The vulnerability lies in the certificate validation process of PCM600 Update Manager, allowing unauthorized software installation.

Affected Systems and Versions

PCM600 by ABB: Versions between 2.7 and 2.10 are affected, with unspecified custom versions also vulnerable.
PCM600 Update Manager by ABB: Versions 2.1 to 2.4.20119.2 are affected.
PCM600 by Hitachi Energy: Versions between 2.7 and 2.10 are affected, with unspecified custom versions also vulnerable.
PCM600 Update Manager by Hitachi Energy: Versions 2.1 to 2.4.20119.2 are affected.

Exploitation Mechanism

Attackers with low privileges can exploit this vulnerability locally, thereby compromising the affected systems' confidentiality, integrity, and availability.

Mitigation and Prevention

To mitigate the CVE-2021-22278 vulnerability, users are advised to:

Immediate Steps to Take

Install the latest PCM600 Update Manager version 2.4.21218.1 or newer to patch the vulnerability.

Long-Term Security Practices

Regularly update and patch all software to prevent vulnerabilities and ensure system security.

Patching and Updates

Stay informed about security updates and patches released by the vendor to protect systems from exploitation.