Skip to content
OpenAdvisories
Critical ICSA-25-252-02 3 CVEs

ABB Cylon Aspect BMS/BAS

Published Sep 9, 2025 · Updated Sep 9, 2025

Vendor: ABB Product: ASPECT Enterprise (ASP-ENT-x) Product: MATRIX Series(MAT-x) Product: NEXUS Series NEX-2x Product: NEXUS Series NEXUS-3-x

Summary

Successful exploitation of these vulnerabilities could allow an attacker to assume control of the target device or perform a denial-of-service (DoS) attack.

Vulnerabilities 3

  • Critical 9.8
    CVE-2025-53187

    Unauthenticated RCE

    Due to an issue in configuration, code that was intended for debugging purposes was included in the market release of the ASPECT FW allowing an attacker to bypass authentication. This vulnerability may allow an attacker to change the system time, access files…

    ABB ASPECT ICS / OT
  • High 8.1
    CVE-2025-7679

    Session ID Basic Auth Bypass

    The ASPECT system allows users to bypass authentication. This issue affects all versions of ASPECT

    ABB ASPECT ICS / OT
  • Medium 5.9
    CVE-2025-7677

    DOS attack possible

    A denial-of-service (DoS) attack is possible if access to the local network is provided to unauthorized users. This is due to a buffer copy issue that may lead to a software crash. This issue affects all versions of ASPECT.

    ABB ASPECT ICS / OT

Revision history

  1. #1

    Initial Publication

References