CVE-2023-3323
Code Execution through overwriting project file on zenon engineering studio system
- Published
- Updated
- Reserved
- Assigned by
- ABB
Description
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts. This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ABBCNA (assigner) | 3.1 | Medium5.9 | CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H |
| NVDNVD · Modified | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.30% · top 77% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Weakness
Affected products
- affected 11 build – ≤ 11 build 106404
What to do
Workaround: ABB recommends the following workarounds. Although these workarounds will not correct the underlying vulnerability, they block the known attack vectors. • For CVE-2023-3323, Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed. Remove the default directory permissions for ‘Everyone’ on the service grid, ABB utilities, and zenon_Projects directories and provide access only to specific users that are expected to access zenon. Install the IIoT services, which is, the Service grid component on a separate system. Secure the ZEE600 related executable files in ‘C:\ProgramData\ABB\ABBUtilities’ directory by removing the group named “Everyone”. Ensure the group name “Everyone” should be removed from the following directory. ‘C:\ProgramData\ABB’. Secure zenon_Projects directory by managing the access permissions. The project directory should have access only for the user group (Excluding administrator) which has the users to use zenon projects. Consider the following example: Example: A user group named ‘zenonOwnersGroup’ to be created and it is the only group that has write access to the zenon_ Projects directory. If the system has 2 users such as test1(Part of zenonOwnersGroup ) and test2 (not in zenonOwnersGroup ). The project directory (C:\Users\Public\Documents\zenon_Projects) should have write access only for the zenonOwnersGroup and for no one else. Now, test1 should have write access the zenon_Project directory and test2 should not.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-3323)Record last updated .