Cyber Resilience

CVE-2023-3321

Abb Zenon ≤ 11.0.0

Published
24 July 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 7.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 29th percentile
Risk Priority 51 floored blend · peak EPSS

Summary

CVE-2023-3321 is a high-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Abb Zenon. Its CVSS base score is 7.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by PATH Environment Variable (T1574.007); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to…

more

run on the zenon installed hosts. This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1574.007 Path Interception by PATH Environment Variable Stealth
Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries.
T1547.004 Winlogon Helper DLL Persistence
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
T1547.014 Active Setup Persistence
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
T1574 Hijack Execution Flow Stealth
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.
T1574.006 Dynamic Linker Hijacking Stealth
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries.
T1574.012 COR_PROFILER Stealth
Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-3323Same product: Abb Zenon
CVE-2023-3322Same product: Abb Zenon
CVE-2024-51544Same vendor: Abb
CVE-2023-3324Same product: Abb Zenon
CVE-2024-51543Same vendor: Abb
CVE-2024-39793Shared CWE-15
CVE-2025-0425Shared CWE-15
CVE-2026-41294Shared CWE-15
CVE-2025-27253Shared CWE-15
CVE-2024-39800Shared CWE-15

Affected Assets

abb
zenon
≤ 11.0.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-15

The policy and procedures establish internal controls and change management for system configuration settings, reducing the feasibility of external unauthorized modifications.

addresses: CWE-15

Baseline configuration under change control directly prevents unauthorized external modification of system or configuration settings.

addresses: CWE-15

Requires approval, documentation, and security impact review of all configuration changes, directly preventing unauthorized external control of system settings.

addresses: CWE-15

Impact analysis of configuration changes reduces the risk of deploying settings that permit unauthorized external control.

addresses: CWE-15

Restricting changes to system and configuration settings prevents external entities from controlling those settings without approval.

addresses: CWE-15

Establishing, implementing, approving deviations from, and monitoring configuration settings directly prevents external or unauthorized control of system settings.

addresses: CWE-15

The plan defines processes for identifying and managing configuration items, preventing external unauthorized control of system settings.

addresses: CWE-15

Vulnerability scanners directly detect externally controllable or misconfigured settings using standardized checklists.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Hardened configuration baselines and change controls directly limit external manipulation of settings.

ID.RA-07 partial match
prevents

Formal change and exception management catches externally driven configuration alterations.

PR.AA-05 partial match
prevents

Least-privilege access policies reduce unauthorized external modification of configuration values.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Configuration management directly prevents external tampering with system settings.

prevents

Access rights assignment determines who may change system settings.

prevents

Privileged access rights reduce the number of users who can alter configuration.

prevents

Information access restriction limits who can view or modify configuration data.

prevents

Change management enforces controlled, authorized modifications to settings.

prevents

Access control policies underpin the technical restrictions on configuration changes.

References