Log Injection Vulnerability in ASPECT, NEXUS, and MATRIX by ABB
CVE-2024-13950

6.9MEDIUM

Key Information:

Vendor

Abb

Status
Aspect-enterprise
Nexus Series
Matrix Series
Vendor
CVE Published:
22 May 2025

What is CVE-2024-13950?

A log injection vulnerability exists in ABB's ASPECT, NEXUS, and MATRIX products, allowing an attacker to inject malicious browser scripts if administrator credentials are compromised. This could lead to unauthorized actions and extensive data breaches, making it crucial for users to assess and mitigate potential risks associated with these affected versions.

Affected Version(s)

ASPECT-Enterprise Linux 0 <= 3.*

MATRIX Series Linux 0 <= 3.*

NEXUS Series Linux 0 <= 3.*

References

https://search.abb.com/library/Download.aspx?DocumentID=9...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ABB likes to thank Gjoko Krstikj, Zero Science Lab, for reporting the vulnerabilities in responsible disclosure
.
CVE-2024-13950 : Log Injection Vulnerability in ASPECT, NEXUS, and MATRIX by ABB