CVE-2019-18998: Asset Suite Direct Object Reference Access

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-17 · updated 2026-06-17
Weakness: CWE-284

Description

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly.

Affected products

Hitachi Energy Asset Suite: from 9.0.0 through 9.3.0; from 9.4 before 9.4.2.6; from 9.5.0 before 9.5.3.2; 9.6.0 — fixed in 9.4.2.6, 9.5.3.2

How to fix

Upgrade to a fixed version: Hitachi Energy Asset Suite 9.4.2.6, 9.5.3.2. Check the vendor advisory for mitigations.

References

https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962&LanguageCode=en&DocumentPartId=&Action=Launch
https://www.us-cert.gov/ics/advisories/icsa-20-072-02
https://search.abb.com/library/Download.aspx?DocumentID=9AKK107492A9962&LanguageCode=en&DocumentPartId=&Action=Launch
https://www.us-cert.gov/ics/advisories/icsa-20-072-02

Get alerted when CVE-2019-18998 or the next vulnerability affects your stack