cbcvebase.
CVE-2024-4007
published 2024-07-01

CVE-2024-4007: Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

PriorityP354high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EXPLOIT
EPSS
1.51%
71.6th percentile
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

Affected

15 ranges
VendorProductVersion rangeFixed in
abbaspect-ent-12_firmware< 3.07.023.07.02
abbaspect-ent-256_firmware< 3.07.023.07.02
abbaspect-ent-2_firmware< 3.07.023.07.02
abbaspect-ent-96_firmware< 3.07.023.07.02
abbaspect_enterprise——
abbmatrix-11_firmware< 3.07.023.07.02
abbmatrix-216_firmware< 3.07.023.07.02
abbmatrix-232_firmware< 3.07.023.07.02
abbmatrix-264_firmware< 3.07.023.07.02
abbmatrix-296_firmware< 3.07.023.07.02
abbmatrix_series——
abbnexus-2128_firmware< 3.07.023.07.02
abbnexus-264_firmware< 3.07.023.07.02
abbnexus-3-2128_firmware< 3.07.023.07.02
abbnexus-3-264_firmware< 3.07.023.07.02

Detection & IOCsextracted from sources · hover to see the quote

othercontroluser: root / controlpass: F@c1liTy↗
path/var/www/html/phpMyAdmin/config.inc.php↗
  • →Detect login attempts using the hard-coded credential pair root / F@c1liTy against phpMyAdmin on ABB ASPECT/NEXUS/MATRIX devices (firmware <=3.07.01) ↗
  • →Flag reads or access of config.inc.php under the phpMyAdmin installation path on affected ABB ASPECT devices as potential credential harvesting activity ↗
  • ·Hard-coded credentials (root / F@c1liTy) are embedded in the install package's phpMyAdmin config.inc.php and apply to all affected firmware versions <=3.07.01 across NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, and ASPECT-Studio product lines ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Red
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.