CVE-2024-13955

SQL Injection 2nd Order

2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2024-48851

Remote Code Execution

Improper Validation of Specified Type of Input vulnerability in ABB FLXEON.A remote code execution is possible due to an improper input validation. This issue affects FLXEON: through 9.3.5.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Flxeon

CVE-2024-9639

Authenticated Remote Code Execution

Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2024-48842

Hardcoded passwords

Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Flxeon

CVE-2024-13949

Log Forging

Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2024-0335

Malformed Packet Handling

ABB has internally identified a vulnerability in the ABB VPNI feature of the S+ Control API component which may be used by several Symphony Plus products (e.g., S+ Operations, S+ Engineering and S+ Analyst) This issue affects Symphony Plus S+ Operations: from 3..0;0 through 3.3 SP1 RU4, from 2.1;0 through 2.1 SP2 RU3, from 2.0;0 through 2.0 SP6 TC6; Symphony Plus S+ Engineering: from 2.1 through 2.3 RU3; Symphony Plus S+ Analyst: from 7.0.0.0 through 7.2.0.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Symphony Plus S\+ Analyst Symphony Plus S\+ Engineering Symphony Plus S\+ Operations

CVE-2024-48850

Authenticated Absolute Path Traversal

Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2024-48853

Authenticated Escalation to guest to root

An escalation of privilege vulnerability in ASPECT could provide an attacker root access to a server when logged in as a "non" root ASPECT user. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2024-13929

Authenticated Servlet Command Injection

Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2024-13930

Authenticated Unchecked Loop Condition

An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2024-13931

Authenticated Relative Path Traversal

Relative Path Traversal vulnerabilities in ASPECT allow access to file resources if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2025-10205

Predictable Salt and Weak Hashing Algorithm

Use of a One-Way Hash with a Predictable Salt vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5. and newer versions

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Flxeon

CVE-2024-13928

Authenticated SQL Injection

SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2024-48848

LARGECONTENT - device disk overutilization

Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2025-10504

Heap Memory Corruption Vulnerability

Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Terra Ac Wallbox Jp

CVE-2025-10571

ABB Ability Edgenius Authentication Bypass

Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Ability Edgenius

CVE-2024-13945

Stored Absolute Path Traversal

Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2021-22291

EIBPORT Reflected XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ABB EIBPORT V3 KNX, ABB EIBPORT V3 KNX GSM.This issue affects EIBPORT V3 KNX: before 3.9.2; EIBPORT V3 KNX GSM: before 3.9.2.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Eibport V3 Knx Eibport V3 Knx Gsm

CVE-2024-13951

One way hash with predictable salt

One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series

CVE-2024-13948

Insecure Permissions

Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Abb

Products

Aspect Enterprise Matrix Series Nexus Series