Critical severity · published Jun 5, 2023
CVE-2023-0635
Improper Privilege Management vulnerability in ABB Ltd
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Privilege Escalation.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.01; NEXUS Series: from 3.0;0 before 3.07.01; MATRIX Series: from 3.0;0 before 3.07.01.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Aspect-ent-12 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
AF
Aspect-ent-2 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
AF
Aspect-ent-256 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
AF
Aspect-ent-96 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-11 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-216 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-232 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-264 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-296 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
NF
Nexus-2128 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
NF
Nexus-2128-a Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
NF
Nexus-2128-f Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0635
Vendor Advisory
https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch
More from Aspect-ent-12 Firmware
10.0
CVE-2024-51551
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise…
10.0
CVE-2024-11317
Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: …
9.9
CVE-2024-6784
Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affected products: ABB…
9.8
CVE-2024-51547
Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through…
9.8
CVE-2024-51554
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise…