Summary
ABB became aware of vulnerabilities in ASPECT product versions listed as affected in the advisory. The earliest report dates to June 2023. ABB has fixed most of the vulnerabilities reported. At the moment there are no plans of corrective measures for remaining vulnerabilities in the affected products.
ASPECT is an on-premise Building Management System (BMS) that provides an additional option to be remotely accessible. In order to support customers’ demand for cloud connectivity, ABB has decided to replace ASPECT and will introduce customers to a new solution based on the latest Industry level cyber security standards. The new solution will bring HW and SW capabilities that reflect state-of-the-art technology and is delivered including a maintenance plan that offers customers the best planning security.
Customers who have concerns about continuing the operation of ASPECT may contact ABB sales service to become advised about further support options.
Vulnerabilities 3
-
Critical 9.8
Unauthenticated RCE
Due to an issue in configuration, code that was intended for debugging purposes was included in the market release of the ASPECT FW allowing an attacker to bypass authentication. This vulnerability may allow an attacker to change the system time, access files…
-
High 8.1
Session ID Basic Auth Bypass
The ASPECT system allows users to bypass authentication. This issue affects all versions of ASPECT
-
Medium 5.9
DOS attack possible
A denial-of-service (DoS) attack is possible if access to the local network is provided to unauthorized users. This is due to a buffer copy issue that may lead to a software crash. This issue affects all versions of ASPECT.
Revision history
-
#6
Correction in the CVE description
-
#5
Updated the CWE for two CVE records
-
#4
Merging CVEs due to a common root cause The following CVE’s have been rejected/removed by ABB: - CVE-2025-53188 - CVE-2025-53189 - CVE-2025-53190 - CVE-2025-53191
-
#3
CVSS vectors and scores corrected
-
#2
CVE correction
-
#1
Initial version.
References
-
ABB CYBERSECURITY ADVISORY - PDF version
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A4462&LanguageCode=en&DocumentPartId=pdf&Action=Launch
-
ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.
https://search.abb.com/library/Download.aspx?DocumentID=HT0038&LanguageCode=en&DocumentPartId=&Action=Launch