ABB vulnerabilities
We track 89 vulnerabilities in ABB products across 60+ products. 89 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
Latest ABB vulnerabilities
- 9.8 Critical severity
ASPECT-Enterprise: Improper Validation of Specified Type of Input
Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 9.4 Critical severity
ASPECT-Enterprise: Improper Limitation of a Pathname to a Restricted Directory
Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 8.8 High severity
ASPECT-Enterprise: Unrestricted Upload of File with Dangerous Type
Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 7.5 High severity
ASPECT-Enterprise: Insufficiently Protected Credentials
Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 9.8 Critical severity
ASPECT-Enterprise: Insufficiently Protected Credentials
Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 8.2 High severity
ASPECT-Enterprise: External Control of System or Configuration Setting
Service Control vulnerabilities allow access to service restart requests and vm configuration settings. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 7.5 High severity
ASPECT-Enterprise: External Control of System or Configuration Setting
Information Disclosure vulnerabilities allow access to application configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 8.2 High severity
ASPECT-Enterprise: Files or Directories Accessible to External Parties
Configuration Download vulnerabilities allow access to dependency configuration information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 7.5 High severity
ASPECT-Enterprise: Improper Control of Filename for Include/Require Statement in PHP Program
Local File Inclusion vulnerabilities allow access to sensitive system information. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 9.1 Critical severity
ASPECT-Enterprise: Use of a Broken or Risky Cryptographic Algorithm
MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affected products: ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01; MATRIX Series v3.08.01
- 7.3 High severity
ASPECT-Enterprise: Cross-Site Request Forgery
Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 9.8 Critical severity
ASPECT-Enterprise: Weak Password Requirements
Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Serie
- 7.5 High severity
ASPECT-Enterprise: Improper Neutralization of Special Elements used in an SQL Command
Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 9.8 Critical severity
ASPECT-Enterprise: Improper Control of Generation of Code
Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 9.8 Critical severity
ASPECT-Enterprise: Improper Control of Generation of Code
Improper Input Validation vulnerability allows Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 10.0 Critical severity
ASPECT-Enterprise: Session Fixation
Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 7.5 High severity
ASPECT-Enterprise: Allocation of Resources Without Limits or Throttling
Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- 7.8 High severity
Mint Workbench I: Unquoted Search Path or Element
Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated privileges by inserting an executable file in the path of the affected service. This issue affects Mint Work
- 9.8 Critical severity
ASPECT-Enterprise: Improper Validation of Specified Type of Input
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely
- 7.5 High severity
ASPECT-Enterprise: Files or Directories Accessible to External Parties
Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized
- 8.8 High severity
ASPECT Enterprise (ASP-ENT-x): Use of Default Credentials
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
- 7.8 High severity
2.4! Display 55, SD/U12.55.11-825: Authentication Bypass by Capture-replay
Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System
- 8.8 High severity
2.4! Display 55, SD/U12.55.11-825: Exposure of Sensitive System Information to an Unauthorized Control Sphere
FDSK Leak in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to take control via access to local KNX Bus-System
- 7.6 High severity
RobotWare 6: Out-of-bounds Write
An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible, or execute arbitrary code. The vulnerability could potentially be exploited to perform unauthorized actions by an attacker. This
- 7.5 High severity
Symphony Plus S+ Operations: Relative Path Traversal
ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products (e.g., S+ Operations, S+ Engineering and S+ Analyst) This issue affects Symphony Plus S+ Operations: from
- 7.5 High severity
Freelance controllers AC 700F: Stack-based Buffer Overflow
ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these vulnerabilities could
- 7.5 High severity
Freelance controllers AC 700F: Numeric Range Comparison Without Minimum Check
ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these vulnerabilities could
- 7.5 High severity
ABB Ability™ zenon: Deserialization of Untrusted Data
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them
- 8.1 High severity
ABB Ability™ zenon: Incorrect Permission Assignment for Critical Resource
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them
- 8.8 High severity
ABB Ability™ zenon: External Control of System or Configuration Setting
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them
- 8.0 High severity
TXpert Hub CoreTec 4: Improper Neutralization of Special Elements used in an OS Command
A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a pa
- 9.8 Critical severity
ASPECT®-Enterprise: Improper Neutralization of Special Elements used in a Command
Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2C
- 9.8 Critical severity
ASPECT®-Enterprise: Use of Weak Credentials
Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021
- 8.8 High severity
Terra AC wallbox (UL40/80A): Improper Authentication
Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symb
- 9.8 Critical severity
My Control System (on-premise): Insecure Storage of Sensitive Information
Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application. Of the services tha
- 9.8 Critical severity
RCCMD: Improper Authentication
Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207.
- 8.8 High severity
Symphony Plus S+ Operations: Improper Authentication
Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3.X through 3.3 SP1, 3.3 SP2.
- 8.8 High severity
Pulsar Plus System Controller NE843_S: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H
- 8.4 High severity
ABB Zenon: Insufficiently Protected Credentials
Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data points and corresponding attributes. Once such engineering data is used the data visualization will be
- 8.2 High severity
ABB Zenon: Improper Limitation of a Pathname to a Restricted Directory
Relative Path Traversal vulnerability in ABB Zenon 8.20 allows the user to access files on the Zenon system and user also can add own log messages and e.g., flood the log entries. An attacker who successfully exploit the vulnerability could access the Zenon ru