Critical severity · published Jun 5, 2023
CVE-2023-0636
Improper Input Validation vulnerability in ABB Ltd
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Command Injection.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.0; NEXUS Series: from 3.0;0 before 3.07.0; MATRIX Series: from 3.0;0 before 3.07.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Aspect-ent-12 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
AF
Aspect-ent-2 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
AF
Aspect-ent-256 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
AF
Aspect-ent-96 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-11 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-216 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-232 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-264 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-296 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
NF
Nexus-2128 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
NF
Nexus-2128-a Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
NF
Nexus-2128-f Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0636
Vendor Advisory
https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch
More from Aspect-ent-12 Firmware
10.0
CVE-2024-51551
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise…
10.0
CVE-2024-11317
Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: …
9.9
CVE-2024-6784
Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affected products: ABB…
9.8
CVE-2024-51547
Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through…
9.8
CVE-2024-51554
Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPECT - Enterprise…