CVE-2019-7229

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its...

8.3 High

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of encryption or authenticity checks against the new firmware HMI software binary files.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.10%Down 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 8.3

Record: CVE-2019-7229
CVSS 3.1: 8.3 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 5.4 MediumAV:A/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-494
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-7229
Updated: 2026-11-02

EUVDEUVD-2019-16773 No score

Record: EUVD-2019-16773
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rrrj-wqph-2cmr No score

The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its...

Record: GHSA-rrrj-wqph-2cmr
Weakness: CWE-295, CWE-494
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-7229 is a high vulnerability (CVSS 8.3) in Abb Board Support Package Un31, published June 24, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. No source names a fixed version.