Vulnerability record · CVE-2019-7232 · published 24 June 2019
CVE-2019-7232: ABB IDAL HTTP Server Host Header Buffer Overflow
Abb · Pb610 Panel Builder 600 Firmware
The ABB IDAL HTTP server overflows a stack buffer when a web request carries a Host header of 2047 bytes or more, overwriting a Structured Exception Handler (SEH) address. Because the overwrite is attacker-controlled, the flaw can lead to remote code execution on the server. It matters because the server is reachable without credentials and the affected product is industrial panel-building firmware.
Description
The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and overwrites a Structured Exception Handler (SEH) address. An unauthenticated attacker can submit a Host header value of 2047 bytes or more to overflow the buffer and overwrite the SEH address, which can then be leveraged to execute attacker-controlled code on the server.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityUnauthenticated adjacent-network code execution with public exploit code and very high EPSS, though not in KEV and requiring local network access.
What it is
The ABB IDAL HTTP server overflows a stack buffer when a web request carries a Host header of 2047 bytes or more, overwriting a Structured Exception Handler (SEH) address. Because the overwrite is attacker-controlled, the flaw can lead to remote code execution on the server. It matters because the server is reachable without credentials and the affected product is industrial panel-building firmware.
Impact
An unauthenticated attacker can overwrite the SEH address and potentially execute arbitrary code on the server, gaining full control of the affected host. CVSS 3.1 scores it 8.8 (HIGH) with high confidentiality, integrity and availability impact.
Attack surface
Reached over the network via the IDAL HTTP server; the CVSS vector AV:A indicates the attacker must be on the same adjacent network segment. No authentication (PR:N) and no user interaction (UI:N) are required.
Exploitation
Public exploit code is referenced (Packet Storm, Full Disclosure) and EPSS is 0.52093 (98.9th percentile), indicating elevated likelihood, but the CVE is not listed in CISA KEV and no ransomware use is documented.
What to do
- Apply the vendor patch referenced in ABB advisory 3ADR010377 (search.abb.com document download).
- If patching is not immediately possible, restrict network access to the IDAL HTTP server to trusted hosts and segments only.
- Place the server behind a reverse proxy or WAF that rejects or normalizes oversized Host headers.
- Segment the affected panel-builder network from general IT and internet-facing networks.
- Monitor vendor advisories for updated firmware and re-verify the fix after deployment.
Detection
- Alert on HTTP requests with Host header values of 2047 bytes or longer reaching the IDAL server.
- Inspect web server and proxy logs for unusually long Host headers or malformed request lines.
- Watch for crashes or unexpected restarts of the IDAL HTTP service, which may indicate a failed overflow attempt.
- Monitor for post-exploitation behavior such as new processes spawned by the web server service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-7232 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-7232), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
