Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 236

Export CSV
CVE-2023-0580

Information Disclosure vulnerability in My Control System (on-premise)

Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application. Of the services that make up the My Control System (on-premise) application, the following ones are affected by this vulnerability: User Interface System Monitoring1 Asset Inventory This issue affects My Control System (on-premise): from 5.0;0 through 5.13.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Abb
Products
My Control System
CVE-2023-0863

Authentication to access the AC wallbox via its Bluetooth Low Energy (BLE) channel can be bypassed,

Improper Authentication vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Terra Ac Wallbox 80a Terra Ac Wallbox 80a Firmware Terra Ac Wallbox Ce Juno and 13 more
CVE-2023-0864

Configuration data is exchanged in plaintext and could be available to a nearby attacker if present during configuration or usage of the device via Bluetooth Low Energy (BLE).

Cleartext Transmission of Sensitive Information vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (CE) (Terra AC MID), ABB Terra AC wallbox (CE) Terra AC Juno CE, ABB Terra AC wallbox (CE) Terra AC PTB, ABB Terra AC wallbox (CE) Symbiosis, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): from 1.0;0 through 1.5.5; Terra AC wallbox (UL32A) : from 1.0;0 through 1.6.5; Terra AC wallbox (CE) (Terra AC MID): from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC Juno CE: from 1.0;0 through 1.6.5; Terra AC wallbox (CE) Terra AC PTB : from 1.0;0 through 1.5.25; Terra AC wallbox (CE) Symbiosis: from 1.0;0 through 1.2.7; Terra AC wallbox (JP): from 1.0;0 through 1.6.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Terra Ac Wallbox 80a Terra Ac Wallbox 80a Firmware Terra Ac Wallbox Ce Juno and 13 more
CVE-2022-0010

QCS 800xA Vulnerability identified in system log files

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could have the potential to exploit this vulnerability to gain control of system nodes. This issue affects QCS 800xA: from 1.0;0 through 6.1SP2; QCS AC450: from 1.0;0 through 5.1SP2; Platform Engineering Tools: from 1.0:0 through 2.3.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Platform Engineering Tools Qcs 800xa Qcs 800xa Firmware and 2 more
CVE-2023-0636

Remote Code Execution via Command Injection

Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Command Injection.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.0; NEXUS Series: from 3.0;0 before 3.07.0; MATRIX Series: from 3.0;0 before 3.07.1.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 35 more
CVE-2023-0635

Privilege escalation to root

Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Privilege Escalation.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.01; NEXUS Series: from 3.0;0 before 3.07.01; MATRIX Series: from 3.0;0 before 3.07.01.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 35 more
CVE-2023-2876

Session cookie exposure for client side script

Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware modules) allows Cross-Site Scripting (XSS).This issue affects REX640 PCL1: from 1.0;0 before 1.0.8; REX640 PCL2: from 1.0;0 before 1.1.4; REX640 PCL3: from 1.0;0 before 1.2.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Rex640 Pcl1 Rex640 Pcl1 Firmware Rex640 Pcl2 and 3 more
CVE-2024-6515

unauthorized file access

Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-6516

Cross Site Scripting XSS

Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-48839

Remote Code Execution, RCE

Improper Input Validation vulnerability allows Remote Code Execution.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS 4.0 · 9.3 Critical EPSS 2.8% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-48843

Denial of Service, DoS

Denial of Service vulnerabilities where found providing a potiential for device service disruptions.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-48844

Denial of Service, DoS

Denial of Service vulnerabilities where found providing a potiential for device service disruptions.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-48845

Weak Password Rules/Strength

Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-48846

Cross Side Request Forgery, CSRF

Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-48847

MD5 bypass operation

MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes.  Affected products: ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01; MATRIX Series v3.08.01

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-51541

Local File Inclusion

Local File Inclusion vulnerabilities allow access to sensitive system information.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-51549

Absolute Path Traversal

Absolute File Traversal vulnerabilities allows access and modification of un-intended resources.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-51550

Data Validation / Sanitization

Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more
CVE-2024-51551

Default Credentials

Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Abb
Products
Aspect-ent-12 Aspect-ent-12 Firmware Aspect-ent-2 and 38 more