vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-24673

SQL Injection in Symphony Plus

CRITICAL
9.8
CVSS Score
Published: December 22, 2020 at 09:21 PM UTC
Updated: June 17, 2026 at 03:05 AM UTC
2 products affected across 1 vendorSymphony + OperationsSymphony + Historian

Using ABB Ability™ Symphony® Plus Operations by ABB?

Get instant alerts when new vulnerabilities affect ABB Ability™ Symphony® Plus Operations - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
CRITICAL9.8
Exploit prediction
EPSS 1%

Description

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can lead to a loss of confidentiality and data integrity or even affect the product behavior and its availability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Symphony + Historian· ABB
95%
v < 3.23.03.1
Affected range stops below 3.2, so it looks safe — our inference, not a vendor statement
Symphony + Operations· ABB
95%
v < 2.1 SP2 Rollup 2v < 2.2v < 3.3 Service Pack 11.12.02.1 sp12.1 sp23.03.13.23.3
Affected range stops below 2.1 SP2 Rollup 2, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.3 Service Pack 1, so it looks safe — our inference, not a vendor statement

References (2)

x_refsource_MISCMitigationVendor Advisory
Source: [email protected]
https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
x_refsource_MISCMitigationVendor Advisory
Source: [email protected]
https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch

CVSS

9.8CRITICALABB
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-89

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card