Abb Matrix Series vulnerabilities

CVE-2024-13957 [HIGH] CWE-918 CVE-2024-13957: SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become SSRF Server Side Request Forgery vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-48843 [HIGH] CWE-770 CVE-2024-48843: Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

CVE-2024-13952 [HIGH] CWE-94 CVE-2024-13952: Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attac Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2025-30169 [MEDIUM] CWE-434 CVE-2025-30169: File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrato File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVE-2024-13948 [HIGH] CWE-276 CVE-2024-13948: Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of co Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2025-30173 [MEDIUM] CWE-434 CVE-2025-30173: File upload vulnerabilities are present in ASPECT if session administrator credentials become compro File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVE-2024-13956 [MEDIUM] CWE-295 CVE-2024-13956: SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromi SSL Verification Bypass vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-51553 [MEDIUM] CWE-73 CVE-2024-51553: Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attac Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-48848 [MEDIUM] CWE-774 CVE-2024-48848: Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a s Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-13950 [MEDIUM] CWE-79 CVE-2024-13950: Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-13949 [MEDIUM] CWE-117 CVE-2024-13949: Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a s Large content vulnerabilities are present in ASPECT exposing a device to disk overutilization on a system if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-13945 [MEDIUM] CWE-36 CVE-2024-13945: Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrat Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-51552 [MEDIUM] CWE-257 CVE-2024-51552: Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromise Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-13947 [MEDIUM] CWE-863 CVE-2024-13947: Device commissioning parameters in ASPECT may be modified by an external source if administrative cr Device commissioning parameters in ASPECT may be modified by an external source if administrative credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2025-30170 [MEDIUM] CWE-497 CVE-2025-30170: Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers acces Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVE-2024-13954 [MEDIUM] CWE-922 CVE-2024-13954: Serialized configuration information may be disclosed during device commissioning while using ASPECT Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-13953 [MEDIUM] CWE-359 CVE-2024-13953: Sensitive device logger information in ASPECT may be exposed if administrator credentials become com Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

CVE-2024-13930 [MEDIUM] CWE-606 CVE-2024-13930: An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system An Unchecked Loop Condition in ASPECT provides an attacker the ability to maliciously consume system resources if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

CVE-2024-13958 [MEDIUM] CWE-79 CVE-2024-13958: Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become com Stored Cross Site Scripting vulnerabilities exist in ASPECT if administrator creden-tials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.