CVE-2019-18250

Published: Nov 26, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication bypass, which may allow an attacker to remotely bypass authentication and extract credentials from the affected device.

Affected (2)

Products: Abb: Plant Connect, Power Generation Information Manager

2 products

Power Generation Information Manager

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Abb Plant Connect	All versions
Abb Power Generation Information Manager	All versions

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (3)

https://www.us-cert.gov/ics/advisories/icsa-19-318-05

Source: ics-cert@hq.dhs.gov

Not ApplicablePermissions RequiredThird Party AdvisoryUS Government Resource

https://iotsecuritynews.com/abb-power-generation-information-manager-pgim-and-plant-connect/

Source: nvd@nist.gov

Third Party Advisory

https://www.us-cert.gov/ics/advisories/icsa-19-318-05

Source: af854a3a-2127-422b-91ae-364da2661108

Not ApplicablePermissions RequiredThird Party AdvisoryUS Government Resource

Timeline

No history available yet.