ASPECT advisory PHP Vulnerabilities

- General statement

ABB became aware of vulnerabilities in ASPECT versions listed as affected in the advisory. The earliest report dates to Oct 2026. An attacker who successfully exploits these vulnerabilities may insert and run arbitrary code on affected products. ABB is currently investigating this vulnerability to provide adequate protection to customers.

ASPECT is an on-premises Building Management System (BMS) that provides an additional option to be remotely accessible.

- Statement on newly reported vulnerabilities

ASPECT devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers regarding this fact.

An attacker who successfully exploits these vulnerabilities could potentially gain unauthorized access and potentially compromise the system's - and log-file-confidentiality, integrity and availability.

ABB requires, as noted in previous security advisories and user documentation, that ASPECT should not be exposed to the Internet or any other unsecured network.

Note: To exploit ASPECT, an attacker would need a misconfigured system.

ABB strongly advises customers and system integrators to follow the instructions documented in: FBXi, CBXi and ASPECT® SOLUTIONS, which can be downloaded from the ABB library.