critical9.8
CVE-2020-24683
The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (cl…
Impact
The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Abb | Symphony \+ Historian | Versions 3.0, 3.1 |
| Abb | Symphony \+ Operations | Versions 1.1, 2.0, 2.1, 3.0, 3.1, 3.2 |