CVE-2020-8479

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2020
Source publication: Apr 29, 2020
Source updated: Aug 4, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

ABB Central Licensing System - XML External Entity Injection

For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5. an XML External Entity Injection vulnerability exists that allows an attacker to read or call arbitrary files from the license server and/or from the network and also block the license handling.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Central Licensing System

Vendor: ABB
Product: Central Licensing System
Platforms: Unknown
Default status: Unknown

Central Licensing System · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.1	`affected`	custom	5*	Unavailable	None listed

ABB Ability System 800xA

Vendor: ABB
Product: ABB Ability System 800xA
Platforms: Unknown
Default status: Unknown

ABB Ability System 800xA · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.1	`affected`	Unavailable	Unavailable	Unavailable	None listed

Compact HMI

Vendor: ABB
Product: Compact HMI
Platforms: Unknown
Default status: Unknown

Compact HMI · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

Control Builder Safe

Vendor: ABB
Product: Control Builder Safe
Platforms: Unknown
Default status: Unknown

Control Builder Safe · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
1.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

Symphony Plus S+ Operations

Vendor: ABB
Product: Symphony Plus S+ Operations
Platforms: Unknown
Default status: Unknown

Symphony Plus S+ Operations · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3	`affected`	custom	Unavailable	3.2	None listed

Symphony Plus S+ Engineering

Vendor: ABB
Product: Symphony Plus S+ Engineering
Platforms: Unknown
Default status: Unknown

Symphony Plus S+ Engineering · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.1	`affected`	custom	Unavailable	2.2	None listed

Composer Harmony

Vendor: ABB
Product: Composer Harmony
Platforms: Unknown
Default status: Unknown

Composer Harmony · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.1	`affected`	Unavailable	Unavailable	Unavailable	None listed

Composer Melody

Vendor: ABB
Product: Composer Melody
Platforms: Unknown
Default status: Unknown

Composer Melody · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.3	`affected`	Unavailable	Unavailable	Unavailable	None listed
6	`affected`	custom	Unavailable	6.3	None listed

Harmony OPC Server Standalone

Vendor: ABB
Product: Harmony OPC Server Standalone
Platforms: Unknown
Default status: Unknown

Harmony OPC Server Standalone · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
6.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
7.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

Advant OCS Control Builder A

Vendor: ABB
Product: Advant OCS Control Builder A
Platforms: Unknown
Default status: Unknown

Advant OCS Control Builder A · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.3	`affected`	Unavailable	Unavailable	Unavailable	None listed
1.4	`affected`	Unavailable	Unavailable	Unavailable	None listed

Composer CTK

Vendor: ABB
Product: Composer CTK
Platforms: Unknown
Default status: Unknown

Composer CTK · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
6.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.2	`affected`	Unavailable	Unavailable	Unavailable	None listed

AdvaBuild

Vendor: ABB
Product: AdvaBuild
Platforms: Unknown
Default status: Unknown

AdvaBuild · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
3.7 SP1	`affected`	Unavailable	Unavailable	Unavailable	None listed
3.7 SP2	`affected`	Unavailable	Unavailable	Unavailable	None listed

OPC Server for Mod 300 (non-800xA)

Vendor: ABB
Product: OPC Server for Mod 300 (non-800xA)
Platforms: Unknown
Default status: Unknown

OPC Server for Mod 300 (non-800xA) · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.4	`affected`	Unavailable	Unavailable	Unavailable	None listed

OPC Data Link

Vendor: ABB
Product: OPC Data Link
Platforms: Unknown
Default status: Unknown

OPC Data Link · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.2	`affected`	Unavailable	Unavailable	Unavailable	None listed

Knowledge Manager

Vendor: ABB
Product: Knowledge Manager
Platforms: Unknown
Default status: Unknown

Knowledge Manager · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
8.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
9.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
9.1	`affected`	Unavailable	Unavailable	Unavailable	None listed

Manufacturing Operations Management

Vendor: ABB
Product: Manufacturing Operations Management
Platforms: Unknown
Default status: Unknown

Manufacturing Operations Management · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1812	`affected`	Unavailable	Unavailable	Unavailable	None listed
1909	`affected`	Unavailable	Unavailable	Unavailable	None listed

Advant OCS AC 100 OPS Server

Vendor: ABB
Product: Advant OCS AC 100 OPS Server
Platforms: Unknown
Default status: Unknown

Advant OCS AC 100 OPS Server · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.1	`affected`	Unavailable	Unavailable	Unavailable	None listed

ABB Ability™ SCADAvantage

Vendor: ABB
Product: ABB Ability™ SCADAvantage
Platforms: Unknown
Default status: Unknown

ABB Ability™ SCADAvantage · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.1	`affected`	custom	unspecified	Unavailable	None listed
unspecified	`affected`	custom	Unavailable	5.6.5	None listed