All information products included in http://ics-cert.us-cert.gov are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see http://www.us-cert.gov/tlp/.
A cross-site scriptinga vulnerability exists in the system used by the ABB Electrical Distribution Management System (DMS) product netCADOPS to generate online Help.
All releases of the ABB netCADOPS product.
The ABB Network Manager DMS client products ORMap and OMI are not affected by this problem, because this vulnerability is related solely to netCADOPS web-based online Help. Further, no other ABB SCADA products, including, but not limited to, MicroSCADA Pro, RANGER, Network Manager NM-R, and 800xA are affected by this vulnerability.
At this time, ICS-CERT has not independently verified the vulnerability or update to determine the condition details and potential impact to organizations. ICS-CERT is providing this notice to make organizations aware of the vulnerability and patch release from ABB. ICS-CERT recommends that organizations contact ABB for additional details to evaluate the impact of this vulnerability based on their environment, architecture, and product implementation.
ABB is a power and automation technology company. The ABB DMS is used by electric utilities to manage their distribution level infrastructure.
ABB recommends removing the netCADOPS Help files from the netCADOPS web server installation directory.
A new Help system that resolves the vulnerability is included in the NM DMS 18.104.22.168.201002160 patch release. Contact your ABB Network Management software maintenance services representative or Doug Wall (email@example.com) for further instructions.
The Control System Security Program also provides a recommended practices section for control systems on the US-CERT website. Several recommended practices are available for reading or download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
- a. http://www.owasp.org/index.php/Cross-siteScripting(XSS)
For any questions related to this report, please contact the NCCIC at:
Toll Free: 1-888-282-0870
The NCCIC continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product.