CVE-2022-1607
Cross Site Scripting vulnerability in NE843 Pulsar Plus Controller
- Published
- Updated
- Reserved
- Assigned by
- ABB
Description
Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ABBCNA (assigner) | 3.1 | Medium4.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.6.
Weakness
Affected products
ABB · Pulsar Plus System Controller NE843_S
- affected comcode 150042936
- affected H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415
What to do
Workaround: A workaround is to use the controller’s Read/Write Enable/Disable feature for a network port (NET1,WRE=0). The controller can disable all writes over the network port. The factory default is to have the write capability enabled. However, some customers do not want settings to be remotely changed once systems are set. This feature, when set to Disable, will allow no changes to be accepted. Once set it can only be changed locally through the front panel. ABB has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they can help block known attack vectors. When a workaround reduces functionality, this is identified below as “Impact of workaround”
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-1607)Record last updated .