Unauthorized Resource Access and Unintended Information Disclosure Vulnerabilities in ABB Enterprise
CVE-2024-6784

9.9CRITICAL

Key Information:

Vendor

Abb

Status
Aspect-enterprise
Nexus Series
Matrix Series
Vendor
CVE Published:
5 December 2024

What is CVE-2024-6784?

A vulnerability has been identified in several products from ABB, exposing them to Server-Side Request Forgery (SSRF) attacks. This flaw allows an attacker to send crafted requests from the server, potentially gaining access to restricted resources and leading to unintended information disclosure. The affected versions include ABB ASPECT - Enterprise, NEXUS Series, and MATRIX Series, all running version 3.08.02. Organizations using these products should evaluate their security posture and implement mitigations to safeguard against possible exploitation.

Affected Version(s)

ASPECT-Enterprise Linux 0 <= 3.08.02

MATRIX Series Linux 0 <= 3.08.02

NEXUS Series Linux 0 <= 3.08.02

References

https://search.abb.com/library/Download.aspx?DocumentID=9...

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ABB likes to thank Gjoko Krstikj, Zero Science Lab, for reporting the vulnerabilities in responsible disclosure
.