CVE-2019-10995

Name: CVE-2019-10995
Creator: NVD / NIST
Published: 2020-01-14T17:15:12.427+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 0.73%

Last modified Jun 17, 2026

CVE-2019-10995 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.. EPSS estimates a 0.73% chance of exploitation in the next 30 days.

Description

ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.73%

49.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Abb	Cp651 Firmware	<= bsp_un30_1.76
Abb	Cp651-Web Firmware	<= bsp_un30_1.76
Abb	Cp661-Web Firmware	<= bsp_un30_1.76
Abb	Cp661 Firmware	<= bsp_un30_1.76
Abb	Cp665 Firmware	<= bsp_un30_1.76
Abb	Cp665-Web Firmware	<= bsp_un30_1.76
Abb	Cp676-Web Firmware	<= bsp_un30_1.76
Abb	Cp676 Firmware	<= bsp_un30_1.76

References

http://www.securityfocus.com/bid/108928Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-19-178-02Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/108928Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-19-178-02Third Party Advisory, US Government Resource

Timeline

Published: Jan 14, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-10995?

ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.

How severe is CVE-2019-10995?

CVE-2019-10995 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.73% probability of exploitation in the next 30 days.

How do I fix CVE-2019-10995?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-10995?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST