CVE-2024-4007

Published: Jul 1, 2024Modified: Jun 17, 2026

8.7

Vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Red

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:RedShow less

Source: cybersecurity@ch.abb.com (Secondary)

Description

Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

Affected (13)

Products: Abb: Aspect Ent 12 Firmware, Aspect Ent 2 Firmware, Aspect Ent 256 Firmware, Aspect Ent 96 Firmware, Matrix 11 Firmware, Matrix 216 Firmware, Matrix 232 Firmware, Matrix 264 Firmware, Matrix 296 Firmware, Nexus 2128 Firmware, Nexus 264 Firmware, Nexus 3 2128 Firmware, Nexus 3 264 Firmware

Abb

13 products

Aspect Ent 12 Firmware

Aspect Ent 2 Firmware

Aspect Ent 256 Firmware

Aspect Ent 96 Firmware

Nexus 3 2128 Firmware

Nexus 3 264 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Aspect Ent 12 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Aspect Ent 12	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Aspect Ent 2 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Aspect Ent 2	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Aspect Ent 256 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Aspect Ent 256	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Aspect Ent 96 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Aspect Ent 96	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Matrix 11 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Matrix 11	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Matrix 216 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Matrix 216	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Matrix 232 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Matrix 232	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Matrix 264 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Matrix 264	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Matrix 296 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Matrix 296	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Nexus 2128 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Nexus 2128	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Nexus 264 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Nexus 264	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Nexus 3 2128 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Nexus 3 2128	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Nexus 3 264 Firmware	Before 3.07.02

Running on/with	Platform Versions
Abb Nexus 3 264	All versions

Related CWEs

CWE-1392

Use of Default Credentials

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

References (2)

https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A6101&LanguageCode=en&DocumentPartId=&Action=Launch

Source: cybersecurity@ch.abb.com

Vendor Advisory

https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A6101&LanguageCode=en&DocumentPartId=&Action=Launch

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.