Skip to content
Fencer Vulns
high 8.8

CVE-2019-7225 json

The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.

published 2019-06-27 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-16769

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the provisioning tool "Panel Builder 600" to flash a new interface and Tags (MODBUS coils) mapping to the HMI. These credentials are the idal123 password for the IdalMaster account, and the exor password for the exor account. These credentials are used over both HTTP(S) and FTP. There is no option to disable or change these undocumented credentials. An attacker can use these credentials to login to ABB HMI to read/write HMI configuration files and also to reset the device. This affects ABB CP635 HMI, CP600 HMIClient, Panel Builder 600, IDAL FTP server, IDAL HTTP server, and multiple other HMI components.

Patch / fix

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-178-01 updated cvss 8.8

ABB PB610 Panel Builder 600

  • ABB PB610 Panel Builder 600 order code 1SAP500900R0101, 1.91 <= 2.8.0.367
    affected: mitigation “PB610 Panel Builder 600: v2.8.0.424.” library.e.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-19-178-03 updated cvss 8.8

ABB CP635 HMI

  • ABB CP620 1SAP520100R0001, G1 with BSP <= UN31 1.76, 1SAP520100R4001, G1 with BSP <= UN31 1.76 ABB CP620-WEB 1SAP520200R0001, G1 with BSP <= UN31 1.76 ABB CP630 1SAP530100R0001, G1 with BSP <= UN31 1.76 ABB CP630-WEB 1SAP530200R0001, G1 with BSP <= UN31 1.76 ABB CP635 1SAP535100R0001, G1 with BSP <= UN31 1.76, 1SAP535100R5001, G1 with BSP <= UN31 1.76 ABB CP635-B 1SAP535100R2001, G1 with BSP <= UN31 1.76
    +1 more products
    ABB CP635-WEB 1SAP535200R0001, G1 with BSP <= UN31 1.76
    affected: mitigation “ABB recommends users apply the BSP update on affected CP600 control panels at their earliest convenience.” library.e.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.90% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • darkmatter.ae https://www.darkmatter.ae/xen1thlabs/abb-hmi-hardcoded-credentials-vulnerability-xl-19-009/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 5.8 AV:A/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-798 Use of Hard-coded Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.