Skip to content
OpenAdvisories

Vendor

ABB

227 known vulnerabilities.

Products

ASPECT-Enterprise 60 NEXUS Series 60 MATRIX Series 60 eSOMS 13 ABB Ability™ Symphony® Plus Operations 9 ABB Ability™ Symphony® Plus Historian 8 FLXEON 7 Symphony Plus S+ Operations 7 Control Builder Safe 6 Symphony Plus S+ Engineering 6 RMC-100 LITE 5 Mint WorkBench 5 Central Licensing System 5 ABB Ability System 800xA 5 Compact HMI 5 Composer Harmony 5 Composer Melody 5 Harmony OPC Server Standalone 5 Advant OCS Control Builder A 5 Composer CTK 5 AdvaBuild 5 OPC Server for Mod 300 (non-800xA) 5 OPC Data Link 5 Knowledge Manager 5 Manufacturing Operations Management 5 Advant OCS AC 100 OPS Server 5 ABB Ability™ zenon 4 Drive Composer entry 4 Drive Composer pro 4 ABB Automation Builder 4 RMC-100 4 T-MAC Plus 4 TG/S 3.2 Telephone Gateway 4 System 800xA Base 3 Base Software for SoftControl 3 ABB Ability™ SCADAvantage 3 RobotWare 6 3 Terra AC wallbox (UL40/80A) 3 Terra AC wallbox (UL32A) 3 Terra AC wallbox (JP) 3
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Medium 6.8
    CVE-2024-13946 Public exploit

    Binary Planting / LoadLibrary DLL's not Signed

    DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 9.4
    CVE-2024-48852 Public exploit

    Information disclosures

    Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.

    ABB FLXEON ICS / OT
  • Critical 9.4
    CVE-2024-48849 Public exploit

    Authentication and Authorization Issues

    Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through <= 9.3.4.

    ABB FLXEON ICS / OT
  • Critical 10.0
    CVE-2024-48841 Public exploit

    Remote Code Execution (RCE) Vulnerabilities

    Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older.

    ABB FLXEON ICS / OT
  • Critical 10.0
    CVE-2024-51550 Public exploit

    Data Validation / Sanitization

    Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • High 7.5
    CVE-2024-51546 Public exploit

    Credentails Disclosure

    Credentials Disclosure vulnerabilities allow access to on board project back-up bundles.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB MATRIX Series NEXUS Series ASPECT-Enterprise ICS / OT
  • High 7.1
    CVE-2024-48846 Public exploit

    Cross Side Request Forgery, CSRF

    Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 9.4
    CVE-2024-48845 Public exploit

    Weak Password Rules/Strength

    Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Ser…

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • High 7.7
    CVE-2024-48844 Public exploit

    Denial of Service, DoS

    Denial of Service vulnerabilities where found providing a potiential for device service disruptions.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • Critical 10.0
    CVE-2024-48840 Public exploit

    Unauthorized Access

    Unauthorized Access vulnerabilities allow Remote Code Execution.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 10.0
    CVE-2024-48839 Public exploit

    Remote Code Execution, RCE

    Improper Input Validation vulnerability allows Remote Code Execution.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 9.0
    CVE-2024-6516 Public exploit

    Cross Site Scripting XSS

    Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 10.0
    CVE-2024-6209 Public exploit EPSS 17%

    unauthorized file access

    Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • Critical 10.0
    CVE-2024-6298 Public exploit EPSS 19%

    remote code execution

    Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • High 8.8
    CVE-2024-4007 Public exploit

    Hard coded default credential contained in install package

    Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

    ABB MATRIX Series(MAT-x) NEXUS Series (NEX-2x, NEXUS-3-x) ASPECT Enterprise (ASP-ENT-x) ICS / OT
  • Medium 5.3
    CVE-2023-1258 Public exploit

    Flow-X disclosure of sensitive information to unauthenticated users

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0.

    ABB Flow-X ICS / OT
  • Unscored —
    CVE-2019-5620 Public exploit EPSS 71%

    ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function

    ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.

    ABB MicroSCADA Pro SYS600 ICS / OT