CVE-2024-13950

mediumpriority · track · 0EPSS 0.004 · 36 %ileCHEU
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.42% (36th) EPSS
CVSS 6.8 · medium
Is it mine?
7 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · abb_psirt

EPSS · scored 2026-10-27

Log injection vulnerabilities in ASPECT provide attacker access to inject malicious browser scripts if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

The vendor does not plan to fix this; mitigate or replace.

  • No fix plannedASP-ENT-xabb_psirt

    ABB recommend applying the "Mitigating factors"

  • No fix plannedMAT-xabb_psirt

    ABB recommend applying the "Mitigating factors"

  • No fix plannedNEX-2xabb_psirt

    ABB recommend applying the "Mitigating factors"

  • No fix plannedNEXUS-3-xabb_psirt

    ABB recommend applying the "Mitigating factors"

02

cvss

Technical severity, 0–10. One row per scoring source.

6.9
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.6–6.9

v3.16.8mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:Nsecondary · cybersecurity@ch.abb.comexploitability 2.3 · impact 4
v3.16.8mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N/E:F/RL:O/RC:Csecondary · ABB PSIRT
v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:Nsecondary · ENISA EU
v4.06.9mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cybersecurity@ch.abb.com
v4.03.6lowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US
05

affected products (7)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • 9AKK108471A0021ELSB/BLBA ASPECT advisory several CVEs2025-05-22csaf · abb_psirtCH

    ABB became aware of vulnerabilities in ASPECT product versions listed as affected in the advisory. The earliest report dates to June 2023. ABB has fixed most of the vulnerabilities reported. At the moment there are no plans of corrective measures for remaining vulnerabilities in the affected products. ASPECT is an on-premise Building Management System (BMS) that provides an additional option to be remotely accessible. In order to support customers’ demand for cloud connectivity, ABB has decided to replace ASPECT and will introduce customers to a new solution based on the latest Industry level cyber security standards. The new solution will bring HW and SW capabilities that reflect state-of-the-art technology and is delivered including a maintenance plan that offers customers the best planning security. Customers who have concerns about continuing the operation of ASPECT may contact ABB sales service to become advised about further support options.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdabb_psirtNVDCVE.orgMITRE
published 2025-05-22modified 2026-06-17
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan