CVE-2019-7226

The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. Specifically, /cgi/loginDefaultUser creates a session in an authenticated state and returns the session ID along with what may be the username and cleartext password of the user. An attacker can then supply an IDALToken value in a cookie, which will allow them to perform privileged operations such as restarting the service with /cgi/restart. A GET request to /cgi/loginDefaultUser may result in "1 #S_OK IDALToken=532c8632b86694f0232a68a0897a145c admin admin" or a similar response.

• CWE-287

• http://packetstormsecurity.com/files/153402/ABB-IDAL-HTTP-Server-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jun/39Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108886Third Party Advisory, VDB Entry
• https://www.darkmatter.ae/xen1thlabs/abb-idal-http-server-authentication-bypass-vulnerability-xl-19-010/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/153402/ABB-IDAL-HTTP-Server-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Jun/39Exploit, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/108886Third Party Advisory, VDB Entry
• https://www.darkmatter.ae/xen1thlabs/abb-idal-http-server-authentication-bypass-vulnerability-xl-19-010/Exploit, Third Party Advisory

Published

Jun 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7219Unauthenticated reflected cross-site scripting (XSS) exists …
• CVE-2019-7220X-Cart V5 is vulnerable to XSS via the CategoryFilter2 param…
• CVE-2019-7221The KVM implementation in the Linux kernel through 4.20.5 ha…
• CVE-2019-7222The KVM implementation in the Linux kernel through 4.20.5 ha…5.5
• CVE-2019-7223InvoicePlane 1.5 has stored XSS via the index.php/invoices/a…
• CVE-2019-7225The ABB HMI components implement hidden administrative accou…8.8
• CVE-2019-7227In the ABB IDAL FTP server, an authenticated attacker can tr…7.3
• CVE-2019-7228The ABB IDAL HTTP server mishandles format strings in a user…8.8
• CVE-2019-7229The ABB CP635 HMI uses two different transmission methods to…8.3
• CVE-2019-7230The ABB IDAL FTP server mishandles format strings in a usern…8.8
• CVE-2019-7231The ABB IDAL FTP server is vulnerable to a buffer overflow w…5.7
• CVE-2019-7232The ABB IDAL HTTP server is vulnerable to a buffer overflow …8.8