PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-51546 ABB CVE debrief

ABB ASPECT systems contain a credentials disclosure vulnerability that allows unauthorized access to on-board project backup bundles. The vulnerability affects ASPECT firmware versions 3.08.02 and earlier across multiple product lines including ASPECT®-Enterprise (ASP-ENT-x), NEXUS Series (NEX-2x, NEXUS-3-x), and MATRIX Series (MAT-x) devices. CISA published this advisory on July 3, 2024, with subsequent updates through December 5, 2024 to reflect patch availability and acknowledgment corrections. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH severity) with a network attack vector, low attack complexity, and no required privileges or user interaction, enabling remote attackers to obtain sensitive credential information from backup bundles. ABB released version 3.08.03 to remediate this issue. Organizations should upgrade affected systems and apply defense-in-depth measures for industrial control systems.

Vendor
ABB
Product
ASPECT®-Enterprise
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-07-03
Original CVE updated
2024-12-05
Advisory published
2024-07-03
Advisory updated
2024-12-05

Who should care

Organizations operating ABB ASPECT building automation or industrial control systems, particularly in critical infrastructure sectors. Security teams responsible for ICS/OT asset management, network defenders monitoring for unauthorized credential access, and compliance officers tracking vulnerability remediation timelines should prioritize this issue given the network-exploitable nature and high confidentiality impact.

Technical summary

The vulnerability exists in the ASPECT firmware's handling of project backup bundles, where credentials are disclosed in a manner that allows unauthorized actors to access sensitive authentication information. The attack is remotely exploitable without authentication, making it particularly dangerous for internet-exposed or poorly segmented ICS networks. The confidentiality impact is rated HIGH while integrity and availability impacts are NONE. The vulnerability was present in firmware through version 3.08.02; version 3.08.03 contains the remediation.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade all affected ABB ASPECT systems to version 3.08.03 or later to remediate the credentials disclosure vulnerability
  • Inventory and identify all deployed ASPECT®-Enterprise, NEXUS Series, and MATRIX Series devices running firmware version 3.08.02 or earlier
  • Restrict network access to ASPECT device management interfaces to authorized administrative hosts only
  • Review and rotate any credentials that may have been exposed in project backup bundles on affected systems
  • Implement network segmentation for industrial control systems per CISA recommended practices
  • Monitor for unauthorized access attempts to ASPECT backup bundle endpoints
  • Apply defense-in-depth strategies including least privilege access and continuous monitoring for ICS environments

Evidence notes

The vulnerability description and affected product versions are derived from CISA CSAF advisory ICSA-25-007-01. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C) indicates network accessibility with low complexity and high confidentiality impact. Remediation guidance specifies version 3.08.03 and later as the vendor fix.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-51546 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-51546

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-51546 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-51546

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-007-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.