CVE-2024-8036

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a specially crafted firmware or configuration to the system node, causing the node to stop, become inaccessible, or allowing the attacker to take control of the node.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H

Weakness enumeration

Affected software

VendorProductVersions
ABBRelion Protection Relays RE_611 IEC>= 1.0.0, <= 1.0.4; >= 2.0.0, <= 2.0.4
ABBRelion Protection Relays REF615 IEC>= 1.0.0, <= 1.2.0
ABBRelion Protection Relays REF615 ANSI>= 1.0.0, <= 1.1.0
ABBRelion Protection Relays REX615PCL1
ABBRelion Protection Relays REX6101.1.1; 1.2.0
ABBRelion Protection Relays REX640>= 1.0.0, <= 1.0.8; >= 1.1.0, <= 1.1.6; >= 1.2.0, <= 1.2.3; >= 1.3.0, <= 1.3.4
ABBSubstation Merging Unit SMU615>= 1.0.0, <= 1.0.3
ABBSmart Substation Control and Protection SSC6001.0; 1.0 FP1; 1.0 FP2; 1.0 FP3; 1.0 FP4
ABBRelion Protection Relays REF615R ANSI>= 4.0.0, <= 4.1.2
ABBRelion Protection Relays RED615 IEC>= 1.0.0, <= 1.1.5
ABBRelion Protection Relays 615 series IEC>= 2.0.0, <= 2.0.9; >= 3.0.0, <= 3.0.10; >= 4.0.0, <= 4.0.8; >= 4.1.9, <= 4.1.10; >= 5.0.0, <= 5.0.17; >= 5.1.0, <= 5.1.24
ABBRelion Protection Relays 615 series CN>= 2.0.0, <= 2.0.9; >= 3.0.0, <= 3..0.7; >= 3.1.0, <= 3.1.10; >= 4.1.0, <= 4.1.9; >= 5.1.0, <= 5.1.4
ABBRelion Protection Relays 615 series ANSI>= 2.0.0, <= 2.0.9; >= 4.0.0, <= 4.0.5; >= 4.1.0, <= 4.1.1; >= 4.2.0, <= 4.2.3; >= 5.1.0, <= 5.1.3
ABBRelion Protection Relays RER615>= 1.0.0, <= 1.1.4; >= 2.0.0, <= 2.0.9
ABBRelion Protection Relays REC615>= 1.0.0, <= 1.1.4; >= 2.0.0, <= 2.0.9
ABBRBX615>= 1.0.0, <= 2.0.0
ABBRER620 ANSI>= 1.0.0, <= 1.3
ABB620 Series IEC/CN>= 2.0.0, <= 2.0.13; >= 2.1.0, <= 2.1.16
ABBRE_630>= 1.1.0, <= 1.1.0 C5; >= 1.2.0, <= 1.2.0 B8; >= 1.3.0, <= 1.3.0 B1
ABBRIO600>= 1.0.0, <= 1.8.8
ABBCOM6003.3; 3.4; 3.5; 4.0; 4.1; 5.0; 5.1
ABBSPA ZC-400Exx; Mxx; Sxx; xMx; Exxx; Mxxx; Sxxx; xMxx; xxxC
ABBCOM600F ANSI4.1; 5.0
ABBSPA ZC-402Exxx; Mxxx; Sxxx; xMxx; xxxC
ABBREF542plusR1.0; R1.1; R2.0; R2.5; R2.5 ATEX; R2.5 SP3; R2.6; R3.0; R3.0 SP1; R3.0 SP3
ABBSUE 30002.6 V4F07x; 3.0FP1 V4F11x; V4D02x; V4E0xx
ABBARG600/ARP600/ARR600/ARC600 single SIM>= 3.x.x, <= 3.4.13
ABBARG600/ARP600 dual SIM>= 2.x.x, <= 3.4.13
ABBARM600>= 4.x.x, <= 5.0.3
ABBREC601/RER601>= 1.1, <= 1.2
ABBREC603/RER603>= 1.1, <= 1.2

References

Timeline

Published
Oct 25, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-80376.5Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with acCVE-2024-80385.5Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available withoutCVE-2024-80399.8Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account taCVE-2024-80407.7An authorization bypass through user-controlled key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an authCVE-2024-80416.5A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 pCVE-2024-80423.1Rapid7 Insight Platform versions between November 2019 and August 14, 2024 suffer from missing authorization issues whereby an attacker can CVE-2024-80435.4The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escapiCVE-2024-80446.5The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackeCVE-2024-80455.4The Advanced WordPress Backgrounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘imageTag’ parameter in all verCVE-2024-80466.4The Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVCVE-2024-80476.5The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackeCVE-2024-80487.8In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecu