ABB ASPECT-Enterprise/NEXUS/MATRIX password recoverable

Summaryinfo

A vulnerability classified as problematic has been found in ABB ASPECT-Enterprise, NEXUS and MATRIX. This affects an unknown function. The manipulation leads to password recoverable. This vulnerability is listed as CVE-2024-51552. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in ABB ASPECT-Enterprise, NEXUS and MATRIX (version now known). This issue affects some unknown processing. The manipulation with an unknown input leads to a password recoverable vulnerability. Using CWE to declare the problem leads to CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. Impacted is confidentiality. The summary by CVE is:

Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

It is possible to read the advisory at search.abb.com. The identification of this vulnerability is CVE-2024-51552 since 10/29/2024. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are necessary for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• ABB

Name

• ASPECT-Enterprise
• MATRIX
• NEXUS

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion