ABB Vulnerabilities and Affected Products
Vulnerabilities associated with MATRIX Series.
Products
Clear product- ASPECT-Enterprise58 vulnerabilities
- MATRIX Series58 vulnerabilities
- NEXUS Series58 vulnerabilities
- matrix_series22 vulnerabilities
- nexus_series22 vulnerabilities
- aspect_enterprise21 vulnerabilities
- eSOMS13 vulnerabilities
- ABB Ability™ Symphony® Plus Operations9 vulnerabilities
- ABB Ability™ Symphony® Plus Historian8 vulnerabilities
- AdvaBuild7 vulnerabilities
- FLXEON7 vulnerabilities
- Symphony Plus S+ Operations7 vulnerabilities
- Control Builder Safe6 vulnerabilities
- Symphony Plus S+ Engineering6 vulnerabilities
- ABB Ability System 800xA5 vulnerabilities
- Advant OCS AC 100 OPS Server5 vulnerabilities
- Advant OCS Control Builder A5 vulnerabilities
- Central Licensing System5 vulnerabilities
- Compact HMI5 vulnerabilities
- Composer CTK5 vulnerabilities
- Composer Harmony5 vulnerabilities
- Composer Melody5 vulnerabilities
- Harmony OPC Server Standalone5 vulnerabilities
- Knowledge Manager5 vulnerabilities
- Manufacturing Operations Management5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-13945HIGH | Stored Absolute Path TraversalStored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-36May 23, 2025 | CVSS8.4v4.0 | EPSS0.384% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-51552HIGH | Weak Password StorageWeak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-257May 22, 2025 | CVSS7.1v4.0 | EPSS0.292% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13958MEDIUM | Stored Cross Site ScriptingStored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-79May 22, 2025 | CVSS4.6v4.0 | EPSS0.203% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13957HIGH | SSRF Server Side Request ForgerySSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-918May 22, 2025 | CVSS7.0v4.0 | EPSS0.263% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13956HIGH | SSL Verification BypassSSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-295May 22, 2025 | CVSS8.8v4.0 | EPSS0.404% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13955CRITICAL | SQL Injection 2nd Order2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-89May 22, 2025 | CVSS9.4v4.0 | EPSS0.34% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13954MEDIUM | Serialization / Deserialization of configuration dataSerialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-922May 22, 2025 | CVSS5.1v4.0 | EPSS0.202% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13953MEDIUM | Sensitive Information disclosed in log filesSensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-359May 22, 2025 | CVSS6.9v4.0 | EPSS0.326% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13952HIGH | Remote Code ExecutionPredictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-94May 22, 2025 | CVSS8.7v4.0 | EPSS0.396% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-51553HIGH | Predictable FilenamePredictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-73May 22, 2025 | CVSS7.0v4.0 | EPSS0.312% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13951MEDIUM | One way hash with predictable saltOne way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-760May 22, 2025 | CVSS6.1v4.0 | EPSS0.182% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13950MEDIUM | Log InjectionLog injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-79May 22, 2025 | CVSS6.9v4.0 | EPSS0.373% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13949MEDIUM | Log ForgingLarge content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-117May 22, 2025 | CVSS6.9v4.0 | EPSS0.345% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-48848HIGH | LARGECONTENT - device disk overutilizationLarge content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-774May 22, 2025 | CVSS7.0v4.0 | EPSS0.334% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13948MEDIUM | Insecure PermissionsWindows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-276May 22, 2025 | CVSS6.9v4.0 | EPSS0.14% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13947HIGH | External System or Configuration ControlDevice commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-863May 22, 2025 | CVSS7.1v4.0 | EPSS0.347% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13946HIGH | Binary Planting / LoadLibrary DLL's not SignedDLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. CWE-427May 22, 2025 | CVSS7.1v4.0 | EPSS0.976% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13931HIGH | Authenticated Relative Path TraversalRelative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. CWE-606May 22, 2025 | CVSS7.5v4.0 | EPSS0.386% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13930MEDIUM | Authenticated Unchecked Loop ConditionAn Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. CWE-606May 22, 2025 | CVSS5.9v4.0 | EPSS0.35% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13929HIGH | Authenticated Servlet Command InjectionServlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. CWE-94May 22, 2025 | CVSS7.5v4.0 | EPSS0.646% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13928HIGH | Authenticated SQL InjectionSQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. CWE-94May 22, 2025 | CVSS7.5v4.0 | EPSS0.346% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-30169MEDIUM | Admin Authorized File Upload and Execute PHPFile upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. CWE-434May 22, 2025 | CVSS6.0v4.0 | EPSS0.324% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-30173MEDIUM | Admin Authorized File UploadFile upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. CWE-434May 22, 2025 | CVSS6.0v4.0 | EPSS0.324% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-30172HIGH | Admin Authorized Remote Code ExecutionRemote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. CWE-94May 22, 2025 | CVSS8.9v4.0 | EPSS0.506% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-30171HIGH | Admin Authorized System File DeletionSystem File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. CWE-863May 22, 2025 | CVSS7.3v4.0 | EPSS0.3% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |