ASPECT-Enterprise vulnerabilities

42 known vulnerabilities in ASPECT-Enterprise from ABB. 42 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  ASPECT-Enterprise: Server-Side Request Forgery

  CVE-2024-13957May 22, 2025ABB

  SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

• 8.8 High severity

  ASPECT-Enterprise: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-13955May 22, 2025ABB

  2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: thr

• 8.4 High severity

  ASPECT-Enterprise: Improper Control of Generation of Code

  CVE-2024-13952May 22, 2025ABB

  Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

• 7.6 High severity

  ASPECT-Enterprise: Use of a One-Way Hash with a Predictable Salt

  CVE-2024-13951May 22, 2025ABB

  One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

• 7.3 High severity

  ASPECT-Enterprise: Incorrect Default Permissions

  CVE-2024-13948May 22, 2025ABB

  Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

• 8.0 High severity

  ASPECT-Enterprise: Improper Control of Generation of Code

  CVE-2025-30172May 22, 2025ABB

  Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

• 9.0 Critical severity

  ASPECT-Enterprise: Incorrect Authorization

  CVE-2025-30171May 22, 2025ABB

  System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through

• 9.1 Critical severity

  ASPECT-Enterprise: Improper Control of Resource Identifiers

  CVE-2025-2410May 22, 2025ABB

  Port manipulation vulnerabilities in ASPECT provide attackers with the ability to con-trol TCP/IP port access if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX

• 9.1 Critical severity

  ASPECT-Enterprise: External Control of File Name or Path

  CVE-2025-2409May 22, 2025ABB

  File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3

• 8.0 High severity

  ASPECT-Enterprise: Improper Control of Generation of Code

  CVE-2024-9639May 22, 2025ABB

  Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

• 7.2 High severity

  ASPECT-Enterprise: Unchecked Input for Loop Condition

  CVE-2024-13931May 22, 2025ABB

  Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

• 7.2 High severity

  ASPECT-Enterprise: Improper Control of Generation of Code

  CVE-2024-13929May 22, 2025ABB

  Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

• 7.2 High severity

  ASPECT-Enterprise: Improper Control of Generation of Code

  CVE-2024-13928May 22, 2025ABB

  SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Seri

• 9.0 Critical severity

  ASPECT-Enterprise: Incorrect User Management

  CVE-2024-48853May 22, 2025ABB

  An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.0

• 7.2 High severity

  ASPECT-Enterprise: Absolute Path Traversal

  CVE-2024-48850May 22, 2025ABB

  Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

• 9.8 Critical severity

  ASPECT-Enterprise: Use of Hard-coded Credentials

  CVE-2024-51547Feb 6, 2025ABB

  Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

• 9.9 Critical severity

  ASPECT-Enterprise: Server-Side Request Forgery

  CVE-2024-6784Dec 5, 2024ABB

  Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 8.1 High severity

  ASPECT-Enterprise: Cleartext Transmission of Sensitive Information

  CVE-2024-6515Dec 5, 2024ABB

  Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.

• 10.0 Critical severity

  ASPECT-Enterprise: Use of Default Password

  CVE-2024-51555Dec 5, 2024ABB

  Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the installer to change default credentials. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v

• 9.8 Critical severity

  ASPECT-Enterprise: Off-by-one Error

  CVE-2024-51554Dec 5, 2024ABB

  Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 10.0 Critical severity

  ASPECT-Enterprise: Use of Hard-coded Credentials

  CVE-2024-51551Dec 5, 2024ABB

  Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02

• 9.8 Critical severity

  ASPECT-Enterprise: Improper Validation of Specified Type of Input

  CVE-2024-51550Dec 5, 2024ABBEPSS 1.81%

  Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.4 Critical severity

  ASPECT-Enterprise: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-51549Dec 5, 2024ABB

  Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 8.8 High severity

  ASPECT-Enterprise: Unrestricted Upload of File with Dangerous Type

  CVE-2024-51548Dec 5, 2024ABB

  Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 7.5 High severity

  ASPECT-Enterprise: Insufficiently Protected Credentials

  CVE-2024-51546Dec 5, 2024ABBEPSS 1.47%

  Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Insufficiently Protected Credentials

  CVE-2024-51545Dec 5, 2024ABB

  Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 8.2 High severity

  ASPECT-Enterprise: External Control of System or Configuration Setting

  CVE-2024-51544Dec 5, 2024ABBEPSS 13.2%

  Service Control vulnerabilities allow access to service restart requests and vm configuration settings. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 7.5 High severity

  ASPECT-Enterprise: External Control of System or Configuration Setting

  CVE-2024-51543Dec 5, 2024ABB

  Information Disclosure vulnerabilities allow access to application configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 8.2 High severity

  ASPECT-Enterprise: Files or Directories Accessible to External Parties

  CVE-2024-51542Dec 5, 2024ABB

  Configuration Download vulnerabilities allow access to dependency configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 7.5 High severity

  ASPECT-Enterprise: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2024-51541Dec 5, 2024ABB

  Local File Inclusion vulnerabilities allow access to sensitive system information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.1 Critical severity

  ASPECT-Enterprise: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2024-48847Dec 5, 2024ABB

  MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affected products: ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01; MATRIX Series v3.08.01

• 7.3 High severity

  ASPECT-Enterprise: Cross-Site Request Forgery

  CVE-2024-48846Dec 5, 2024ABB

  Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Weak Password Requirements

  CVE-2024-48845Dec 5, 2024ABBEPSS 1.82%

  Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Serie

• 7.5 High severity

  ASPECT-Enterprise: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-48843Dec 5, 2024ABB

  Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Improper Control of Generation of Code

  CVE-2024-48840Dec 5, 2024ABBEPSS 2.06%

  Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Improper Control of Generation of Code

  CVE-2024-48839Dec 5, 2024ABBEPSS 2.83%

  Improper Input Validation vulnerability allows Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 10.0 Critical severity

  ASPECT-Enterprise: Session Fixation

  CVE-2024-11317Dec 5, 2024ABB

  Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 7.5 High severity

  ASPECT-Enterprise: Allocation of Resources Without Limits or Throttling

  CVE-2024-11316Dec 5, 2024ABB

  Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Improper Validation of Specified Type of Input

  CVE-2024-6298Jul 5, 2024ABBEPSS 19%

  Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely

• 7.5 High severity

  ASPECT-Enterprise: Files or Directories Accessible to External Parties

  CVE-2024-6209Jul 5, 2024ABBEPSS 17.2%

  Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized