CVE-2019-7232
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a...
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address, which can then be leveraged to execute attacker-controlled code on the server.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address, which can then be leveraged to execute attacker-controlled code on the server.
- Record
CVE-2019-7232- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.8 Medium
AV:A/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address, which can then be leveraged to execute attacker-controlled code on the server.
- Record
CVE-2019-7232- Updated
- 2026-11-02
EUVDEUVD-2019-16776 No score
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address, which can then be leveraged to execute attacker-controlled code on the server.
- Record
EUVD-2019-16776- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cg5v-gm33-jwmv
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a...
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address, which can then be leveraged to execute attacker-controlled code on the server.
- Record
GHSA-cg5v-gm33-jwmv- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-7232 is a high vulnerability (CVSS 8.8) in Abb Pb610 Panel Builder 600 Firmware, published June 24, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 52.1%, the 98th percentile. No source names a fixed version.
References
darkmatter.ae/xen1thlabs/published-advisories
seclists.org/fulldisclosure/2019/Jun/40
search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch
packetstormsecurity.com/files/153403/ABB-IDAL-HTTP-Server-Stack-Based-Buffer-Overflow.html
securityfocus.com/bid/108886
nvd.nist.gov/vuln/detail/CVE-2019-7232
github.com/advisories/GHSA-cg5v-gm33-jwmv