Nexus-264-g Firmware vulnerabilities

27 known vulnerabilities in Nexus-264-g Firmware from ABB. 27 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  ASPECT-Enterprise: Use of Hard-coded Credentials

  CVE-2024-51547Feb 6, 2025ABB

  Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

• 9.9 Critical severity

  ASPECT-Enterprise: Server-Side Request Forgery

  CVE-2024-6784Dec 5, 2024ABB

  Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 8.1 High severity

  ASPECT-Enterprise: Cleartext Transmission of Sensitive Information

  CVE-2024-6515Dec 5, 2024ABB

  Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.

• 9.8 Critical severity

  ASPECT-Enterprise: Off-by-one Error

  CVE-2024-51554Dec 5, 2024ABB

  Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 10.0 Critical severity

  ASPECT-Enterprise: Use of Hard-coded Credentials

  CVE-2024-51551Dec 5, 2024ABB

  Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02

• 9.8 Critical severity

  ASPECT-Enterprise: Improper Validation of Specified Type of Input

  CVE-2024-51550Dec 5, 2024ABBEPSS 1.81%

  Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.4 Critical severity

  ASPECT-Enterprise: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-51549Dec 5, 2024ABB

  Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 8.8 High severity

  ASPECT-Enterprise: Unrestricted Upload of File with Dangerous Type

  CVE-2024-51548Dec 5, 2024ABB

  Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 7.5 High severity

  ASPECT-Enterprise: Insufficiently Protected Credentials

  CVE-2024-51546Dec 5, 2024ABBEPSS 1.47%

  Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Insufficiently Protected Credentials

  CVE-2024-51545Dec 5, 2024ABB

  Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 8.2 High severity

  ASPECT-Enterprise: External Control of System or Configuration Setting

  CVE-2024-51544Dec 5, 2024ABBEPSS 13.2%

  Service Control vulnerabilities allow access to service restart requests and vm configuration settings. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 7.5 High severity

  ASPECT-Enterprise: External Control of System or Configuration Setting

  CVE-2024-51543Dec 5, 2024ABB

  Information Disclosure vulnerabilities allow access to application configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 8.2 High severity

  ASPECT-Enterprise: Files or Directories Accessible to External Parties

  CVE-2024-51542Dec 5, 2024ABB

  Configuration Download vulnerabilities allow access to dependency configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 7.5 High severity

  ASPECT-Enterprise: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2024-51541Dec 5, 2024ABB

  Local File Inclusion vulnerabilities allow access to sensitive system information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.1 Critical severity

  ASPECT-Enterprise: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2024-48847Dec 5, 2024ABB

  MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affected products: ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01; MATRIX Series v3.08.01

• 7.3 High severity

  ASPECT-Enterprise: Cross-Site Request Forgery

  CVE-2024-48846Dec 5, 2024ABB

  Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Weak Password Requirements

  CVE-2024-48845Dec 5, 2024ABBEPSS 1.82%

  Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Serie

• 7.5 High severity

  ASPECT-Enterprise: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-48843Dec 5, 2024ABB

  Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Improper Control of Generation of Code

  CVE-2024-48840Dec 5, 2024ABBEPSS 2.06%

  Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Improper Control of Generation of Code

  CVE-2024-48839Dec 5, 2024ABBEPSS 2.83%

  Improper Input Validation vulnerability allows Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 10.0 Critical severity

  ASPECT-Enterprise: Session Fixation

  CVE-2024-11317Dec 5, 2024ABB

  Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 7.5 High severity

  ASPECT-Enterprise: Allocation of Resources Without Limits or Throttling

  CVE-2024-11316Dec 5, 2024ABB

  Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

• 9.8 Critical severity

  ASPECT-Enterprise: Improper Validation of Specified Type of Input

  CVE-2024-6298Jul 5, 2024ABBEPSS 19%

  Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely

• 7.5 High severity

  ASPECT-Enterprise: Files or Directories Accessible to External Parties

  CVE-2024-6209Jul 5, 2024ABBEPSS 17.2%

  Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized

• 8.8 High severity

  ASPECT Enterprise (ASP-ENT-x): Use of Default Credentials

  CVE-2024-4007Jul 1, 2024ABBEPSS 1.51%

  Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

• 9.8 Critical severity

  ASPECT®-Enterprise: Improper Neutralization of Special Elements used in a Command

  CVE-2023-0636Jun 5, 2023ABBEPSS 1.31%

  Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2C

• 9.8 Critical severity

  ASPECT®-Enterprise: Use of Weak Credentials

  CVE-2023-0635Jun 5, 2023ABB

  Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021