admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-05-06 18:53:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

"-Synchronized-Data."

Browse Source
This commit is contained in:
CVE Team 2025-02-06 05:00:39 +00:00
parent 03b714c60e
commit 4e581a418e
No known key found for this signature in database
GPG Key ID: BC5FD8F2443B23B7
1 changed files with 118 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

122
2024/51xxx/CVE-2024-51547.json
View File

@ -1,17 +1,131 @@
{
"data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-51547",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "cybersecurity@ch.abb.com",
"STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-798: Use of Hard-coded Credentials",
"cweId": "CWE-798"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "ABB",
"product": {
"product_data": [
{
"product_name": "ASPECT-Enterprise",
"version": {
"version_data": [
{
"version_affected": "<=",
"version_name": "0",
"version_value": "3.08.03"
}
]
}
},
{
"product_name": "NEXUS Series",
"version": {
"version_data": [
{
"version_affected": "<=",
"version_name": "0",
"version_value": "3.08.03"
}
]
}
},
{
"product_name": "MATRIX Series",
"version": {
"version_data": [
{
"version_affected": "<=",
"version_name": "0",
"version_value": "3.08.03"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A6775&LanguageCode=en&DocumentPartId=pdf%20-%20Public%20Advisory&Action=Launch",
"refsource": "MISC",
"name": "https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A6775&LanguageCode=en&DocumentPartId=pdf%20-%20Public%20Advisory&Action=Launch"
}
]
},
"generator": {
"engine": "Vulnogram 0.2.0"
},
"source": {
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users accessing ASPECT remotely shall do this using a VPN Gateway allowing access to the particular \nnetwork segment where ASPECT is installed and configured. <br>\nNote: it is crucial that the VPN Gateway and Network is set up in accordance with the best industry standards and maintained in terms of security patches for all related components.<br><br>\n\nThe vulnerabilities reported in scope of this document are only exploitable if attackers can access the \nnetwork segment where ASPECT is installed and exposed directly to the internet. ABB therefore recommends the following guidelines in order to protect customer network:\n<br><br>\u2022 ASPECT devices should never be exposed directly to the Internet either via a direct ISP connection nor via NAT port forwarding. If remote access to an ASPECT system is a customer requirement, the system shall operate behind a firewall. Users accessing ASPECT remotely shall do this \nusing a VPN Gateway allowing access to the particular network segment where ASPECT is installed and configured\n\u2022<br><br>\u2022 Authorized users shall change all default credentials during commissioning of an ASPECT system. If credentials have not been changed during commission state, ABB advises to change each \nchangeable credential at the earliest\n\n<br>"
}
],
"value": "Users accessing ASPECT remotely shall do this using a VPN Gateway allowing access to the particular \nnetwork segment where ASPECT is installed and configured. \n\nNote: it is crucial that the VPN Gateway and Network is set up in accordance with the best industry standards and maintained in terms of security patches for all related components.\n\n\n\nThe vulnerabilities reported in scope of this document are only exploitable if attackers can access the \nnetwork segment where ASPECT is installed and exposed directly to the internet. ABB therefore recommends the following guidelines in order to protect customer network:\n\n\n\u2022 ASPECT devices should never be exposed directly to the Internet either via a direct ISP connection nor via NAT port forwarding. If remote access to an ASPECT system is a customer requirement, the system shall operate behind a firewall. Users accessing ASPECT remotely shall do this \nusing a VPN Gateway allowing access to the particular network segment where ASPECT is installed and configured\n\u2022\n\n\u2022 Authorized users shall change all default credentials during commissioning of an ASPECT system. If credentials have not been changed during commission state, ABB advises to change each \nchangeable credential at the earliest"
}
],
"credits": [
{
"lang": "en",
"value": "ABB acknowledges Gjoko Krstikj, Zero Science Lab, for reporting the potential vulnerabilities in responsible disclosure"
}
],
"impact": {
"cvss": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
]
}