PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-11317 ABB CVE debrief

Session fixation vulnerabilities in ABB ASPECT systems allow attackers to predetermine a user's session identifier prior to authentication, enabling session takeover on affected devices. The vulnerability affects ASPECT versions 3.08.02 and earlier across multiple product lines including ASPECT®-Enterprise (ASP-ENT-x), NEXUS Series (NEX-2x, NEXUS-3-x), and MATRIX Series (MAT-x) devices. This is rated CRITICAL with CVSS 10.0 due to network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity across changed scope. A vendor fix is available in version 3.08.03 and later. The advisory was initially published on July 3, 2024, with subsequent updates in August and November 2024 as patched versions became available, and a final correction on December 5, 2024.

Vendor
ABB
Product
ASPECT®-Enterprise
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2024-07-03
Original CVE updated
2024-12-05
Advisory published
2024-07-03
Advisory updated
2024-12-05

Who should care

Organizations operating ABB ASPECT building automation and energy management systems, particularly in critical infrastructure environments. Security teams responsible for industrial control system (ICS) security, facility management organizations, and OT security practitioners should prioritize patching. Organizations with ASPECT devices exposed to network segments accessible by potential attackers face elevated risk of unauthorized access to building control systems.

Technical summary

The vulnerability exists in the session management implementation of ABB ASPECT systems where an attacker can fix a user's session identifier before the login process completes. This session fixation weakness allows the attacker to know the session ID that will be assigned to an authenticated user, enabling session hijacking after the victim authenticates. The attack requires network access to the ASPECT device but does not require authentication, privileges, or user interaction. Successful exploitation grants the attacker the ability to take over the authenticated session with high impact on confidentiality and integrity of the system. The vulnerability affects four product lines: ASPECT®-Enterprise (ASP-ENT-x), NEXUS Series (NEX-2x, NEXUS-3-x), and MATRIX Series (MAT-x), all at versions 3.08.02 and below. The fix in version 3.08.03 implements proper session identifier regeneration upon authentication.

Defensive priority

critical

Recommended defensive actions

  • Upgrade ABB ASPECT systems to version 3.08.03 or later to remediate session fixation vulnerabilities
  • Verify session management implementations enforce rotation of session identifiers upon successful authentication
  • Review network segmentation for ASPECT devices to limit exposure to untrusted networks
  • Monitor for anomalous session activity including sessions originating from unexpected source addresses
  • Apply defense-in-depth strategies per ICS-CERT recommended practices for industrial control systems

Evidence notes

Source: CISA CSAF advisory ICSA-25-007-01. Affected products confirmed via CSAF product tree: ASP-ENT-x <=3.08.02, NEX-2x <=3.08.02, NEXUS-3-x <=3.08.02, MAT-x <=3.08.02. Remediation confirmed in version 3.08.03 and later. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:F/RL:O/RC:C.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-11317 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-11317

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-11317 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-11317

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-007-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.