Skip to content
OpenAdvisories

Vendor

ABB

227 known vulnerabilities.

Products

ASPECT-Enterprise 60 NEXUS Series 60 MATRIX Series 60 eSOMS 13 ABB Ability™ Symphony® Plus Operations 9 ABB Ability™ Symphony® Plus Historian 8 FLXEON 7 Symphony Plus S+ Operations 7 Control Builder Safe 6 Symphony Plus S+ Engineering 6 RMC-100 LITE 5 Mint WorkBench 5 Central Licensing System 5 ABB Ability System 800xA 5 Compact HMI 5 Composer Harmony 5 Composer Melody 5 Harmony OPC Server Standalone 5 Advant OCS Control Builder A 5 Composer CTK 5 AdvaBuild 5 OPC Server for Mod 300 (non-800xA) 5 OPC Data Link 5 Knowledge Manager 5 Manufacturing Operations Management 5 Advant OCS AC 100 OPS Server 5 ABB Ability™ zenon 4 Drive Composer entry 4 Drive Composer pro 4 ABB Automation Builder 4 RMC-100 4 T-MAC Plus 4 TG/S 3.2 Telephone Gateway 4 System 800xA Base 3 Base Software for SoftControl 3 ABB Ability™ SCADAvantage 3 RobotWare 6 3 Terra AC wallbox (UL40/80A) 3 Terra AC wallbox (UL32A) 3 Terra AC wallbox (JP) 3
All Critical High Medium Low Exploited only Public exploit

227 results · Feed

  • High 7.1
    CVE-2025-3395

    Incorrect Permission Assignment for Critical Resource, Cleartext Storage of Sensitive Information vulnerability in ABB …

    ABB Automation Builder ICS / OT
  • High 7.8
    CVE-2025-3394

    Vulnerability in user management of Automation Builder

    Incorrect Permission Assignment for Critical Resource vulnerability in ABB Automation Builder.This issue affects Automation Builder: through 2.8.0.

    ABB Automation Builder ICS / OT
  • High 7.3
    CVE-2024-10334

    Camera passwords stored in clear text

    A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used.  An attacker who successfully exploited the vulnerability could, in the worst case scenario, stop or manipulate the video feed. This issue aff…

    ABB System 800xA ICS / OT
  • Critical 9.8
    CVE-2024-51547

    Credentials Disclosure - keys

    Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • Critical 9.4
    CVE-2024-48852 Public exploit

    Information disclosures

    Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.

    ABB FLXEON ICS / OT
  • Critical 9.4
    CVE-2024-48849 Public exploit

    Authentication and Authorization Issues

    Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affects FLXEON: through <= 9.3.4.

    ABB FLXEON ICS / OT
  • Critical 10.0
    CVE-2024-48841 Public exploit

    Remote Code Execution (RCE) Vulnerabilities

    Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older.

    ABB FLXEON ICS / OT
  • Medium 4.3
    CVE-2024-12429

    An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists i…

    ABB AC500 V3 ICS / OT
  • High 7.0
    CVE-2024-12430

    An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exis…

    ABB AC500 V3 ICS / OT
  • Critical 10.0
    CVE-2024-51555

    Force Change of Default Credentials

    Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the installer to change default credentials.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series…

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • Critical 9.1
    CVE-2024-51554

    off-by-one-error

    Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 10.0
    CVE-2024-51551

    Default Credentials

    Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 10.0
    CVE-2024-51550 Public exploit

    Data Validation / Sanitization

    Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 10.0
    CVE-2024-51549

    Absolute Path Traversal

    Absolute File Traversal vulnerabilities allows access and modification of un-intended resources.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • Critical 9.9
    CVE-2024-51548

    Dangerous File Upload

    Dangerous File Upload vulnerabilities allow upload of malicious scripts.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB MATRIX Series NEXUS Series ASPECT-Enterprise ICS / OT
  • High 7.5
    CVE-2024-51546 Public exploit

    Credentails Disclosure

    Credentials Disclosure vulnerabilities allow access to on board project back-up bundles.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 10.0
    CVE-2024-51545

    Username Enumeration

    Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • High 8.2
    CVE-2024-51544 EPSS 13%

    Service Control

    Service Control vulnerabilities allow access to service restart requests and vm configuration settings.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • High 8.2
    CVE-2024-51543

    Information Disclosure

    Information Disclosure vulnerabilities allow access to application configuration information.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • High 8.2
    CVE-2024-51542

    Configuration Download

    Configuration Download vulnerabilities allow access to dependency configuration information.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • High 8.2
    CVE-2024-51541

    Local File Inclusion

    Local File Inclusion vulnerabilities allow access to sensitive system information.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • High 8.2
    CVE-2024-48847

    MD5 bypass operation

    MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes.  Affected products: ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01; MATRIX Series v3.08.01

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • High 7.1
    CVE-2024-48846 Public exploit

    Cross Side Request Forgery, CSRF

    Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB MATRIX Series NEXUS Series ASPECT-Enterprise ICS / OT
  • Critical 9.4
    CVE-2024-48845 Public exploit

    Weak Password Rules/Strength

    Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Ser…

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • High 7.7
    CVE-2024-48844 Public exploit

    Denial of Service, DoS

    Denial of Service vulnerabilities where found providing a potiential for device service disruptions.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • High 7.7
    CVE-2024-48843

    Denial of Service, DoS

    Denial of Service vulnerabilities where found providing a potiential for device service disruptions.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 10.0
    CVE-2024-48840 Public exploit

    Unauthorized Access

    Unauthorized Access vulnerabilities allow Remote Code Execution.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • Critical 10.0
    CVE-2024-48839 Public exploit

    Remote Code Execution, RCE

    Improper Input Validation vulnerability allows Remote Code Execution.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 10.0
    CVE-2024-11317

    PHP Session Fixation

    Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • High 7.5
    CVE-2024-11316

    Filesize Check

    Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 9.9
    CVE-2024-6784

    SSRF Server Side Request Forgery

    Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB MATRIX Series NEXUS Series ASPECT-Enterprise ICS / OT
  • Critical 9.0
    CVE-2024-6516 Public exploit

    Cross Site Scripting XSS

    Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 9.6
    CVE-2024-6515

    unauthorized file access

    Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v…

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT
  • Medium 5.9
    CVE-2024-8036

    Unauthorized Modifications of Firmware and Configuration

    ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exploit these vulnerabilities by sending a specially crafted firmware or configuration to the system node, causing the node to stop, become in…

    ABB Relion protection relays - RER615 RBX615 REF542plus ICS / OT
  • Medium 5.1
    CVE-2024-6157

    An attacker who successfully exploited these vulnerabilities could cause the robot to stop. A vulnerability exists in t…

    ABB RobotWare 6 ICS / OT
  • High 8.8
    CVE-2020-11640

    Elevation of Privilege

    AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the command queue can use it to launch an attack by running any executable on the AdvaBuild node. The executables that can be run are not limited to AdvaBuild specifi…

    ABB Advant MOD 300 AdvaBuild ICS / OT
  • High 7.8
    CVE-2020-11639

    Insufficient access control on Inter process communication,

    An attacker could exploit the vulnerability by injecting garbage data or specially crafted data. Depending on the data injected each process might be affected differently. The process could crash or cause communication issues on the affected node, effectively…

    ABB Advant MOD 300 AdvaBuild ICS / OT
  • High 7.8
    CVE-2024-5402

    Mint Workbench I Unquoted Service Path Enumeration

    Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated privileges by inserting an executable file in the path of the affected service. This issue affects Mint Wor…

    ABB Mint Workbench I ICS / OT
  • Critical 10.0
    CVE-2024-6209 Public exploit EPSS 17%

    unauthorized file access

    Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized

    ABB ASPECT-Enterprise MATRIX Series NEXUS Series ICS / OT
  • Critical 10.0
    CVE-2024-6298 Public exploit EPSS 19%

    remote code execution

    Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely

    ABB NEXUS Series ASPECT-Enterprise MATRIX Series ICS / OT