CVE-2023-3324

Insecure deserialization in zenon internal DLLs

Description

A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts. This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.

Remediation

Workaround:

  • The BinaryFormatter class used in implementation of zenon runtime is considered unsafe, as it allows users to create arbitrary classes not limited to the classes the developer intended to deserialize. By deserializing user-controlled content, it may be possible for attackers may potentially load and run random code.  The mitigation steps are as follows: ▪ In the Engineering Studio application remove the .cdwpf files from the graphics folder of each project that contains .cdwpf files created by the 3D Configurator tool. ▪ On the system with the Engineering Studio, for each affected project, remove the RT folder containing the Service Engine files ▪ Compile new files in the Engineering Studio for each affected project ▪ On the system with the Service Engine, remove the RT folder of each affected project ▪ Transport to or place onto the system with the Service Engine the newly created Service Engine files that no longer contain the .cdwpf files • Note: the vulnerability only exists if the 3D configurator tool is used to generate .cdwpf files that are used in screens in projects for display of 3D models

Category

6.3
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.40%
Vendor Advisory abb.com
Affected: ABB ABB Ability™ zenon
Published at:
Updated at:

References

Link Tags
https://search.abb.com/library/Download.aspx?DocumentID=2NGA001801&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.194142766.2067879716.1690216773-1911411808.1686627590 vendor advisory mitigation technical description

Frequently Asked Questions

What is the severity of CVE-2023-3324?
CVE-2023-3324 has been scored as a medium severity vulnerability.
How to fix CVE-2023-3324?
As a workaround for remediating CVE-2023-3324: The BinaryFormatter class used in implementation of zenon runtime is considered unsafe, as it allows users to create arbitrary classes not limited to the classes the developer intended to deserialize. By deserializing user-controlled content, it may be possible for attackers may potentially load and run random code.  The mitigation steps are as follows: ▪ In the Engineering Studio application remove the .cdwpf files from the graphics folder of each project that contains .cdwpf files created by the 3D Configurator tool. ▪ On the system with the Engineering Studio, for each affected project, remove the RT folder containing the Service Engine files ▪ Compile new files in the Engineering Studio for each affected project ▪ On the system with the Service Engine, remove the RT folder of each affected project ▪ Transport to or place onto the system with the Service Engine the newly created Service Engine files that no longer contain the .cdwpf files • Note: the vulnerability only exists if the 3D configurator tool is used to generate .cdwpf files that are used in screens in projects for display of 3D models
Is CVE-2023-3324 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-3324 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-3324?
CVE-2023-3324 affects ABB ABB Ability™ zenon.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.