CVE-2024-48840

criticalpriority · attend · 50EPSS 0.021 · 81 %ileexploit · PoCEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

2.06% (81st) EPSS

CVSS 9.8 · critical

Is it mine?

45 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedASP-ENT-xcisa_csaf_ot
The vulnerabilities have been resolved in the following product versions: 3.08.03 and later.
FixedMAT-xcisa_csaf_ot
The vulnerabilities have been resolved in the following product versions: 3.08.03 and later.
FixedNEX-2xcisa_csaf_ot
The vulnerabilities have been resolved in the following product versions: 3.08.03 and later.
FixedNEXUS-3-xcisa_csaf_ot
The vulnerabilities have been resolved in the following product versions: 3.08.03 and later.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.9–10

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L/E:F/RL:O/RC:Csecondary · CISA US

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Lsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Lsecondary · NCSC-NL NL

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Lsecondary · cybersecurity@ch.abb.comexploitability 3.9 · impact 6

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:Lsecondary · ENISA EU

v4.08.9highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

v4.09.3criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cybersecurity@ch.abb.com

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USCWE-94USCWE-94USCWE-94US

exploits (1)

Public proof-of-concept and weaponised exploit code.

EDB-52251ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command ExecutionPoC · exploit_db

affected products (45)

Products and version ranges known to be affected.

ASP-ENT-x 3.08.03all versionsfixedcisa_csaf_otUS
ASP-ENT-x <=3.08.02all versionscisa_csaf_otUS
MAT-x 3.08.03all versionsfixedcisa_csaf_otUS
MAT-x <=3.08.02all versionscisa_csaf_otUS
NEX-2x 3.08.03all versionsfixedcisa_csaf_otUS
NEX-2x <=3.08.02all versionscisa_csaf_otUS
NEXUS-3-x 3.08.03all versionsfixedcisa_csaf_otUS
NEXUS-3-x <=3.08.02all versionscisa_csaf_otUS
ABB ASP-ENT-x≤ 3.08.02cisa_csaf_otUS
ABB ASP-ENT-xall versionsfixedcisa_csaf_otUS
ABB MAT-xall versionsfixedcisa_csaf_otUS
ABB MAT-x≤ 3.08.02cisa_csaf_otUS
ABB NEX-2x≤ 3.08.02cisa_csaf_otUS
ABB NEX-2xall versionsfixedcisa_csaf_otUS
ABB NEXUS-3-x≤ 3.08.02cisa_csaf_otUS
ABB NEXUS-3-xall versionsfixedcisa_csaf_otUS
ABB ASPECT-Enterprise≤ 0 ≤3.08.02enisa_euvdEU
ABB MATRIX Series≤ 0 ≤3.08.02enisa_euvdEU
ABB NEXUS Series≤ 0 ≤3.08.02enisa_euvdEU
ABB ASPECT-Enterprise ASP-ENT-x≤ 3.08.03fstec_bduRU

showing 20 of 45

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2024-0465Kwetsbaarheden verholpen in ABB ASPECT, NEXUS Series en MATRIX SeriesNL2024-12-06csaf · ncsc_nlNL
ABB heeft kwetsbaarheden verholpen in ABB ASPECT, NEXUS Series en MATRIX Series (Specifiek voor versies tot 3.08.02).
ICSA-25-007-01ABB ASPECT System2024-07-03icsa · cisa_csaf_otUS
ABB became aware of vulnerabilities in the product versions listed as affected in the advisory. ASPECT devices are not intended to be internet-facing. A product advisory issued in June 2023 informed cus-tomers of this parameter. An attacker can successfully exploit these vulnerabilities and could take remote control of the product and po-tentially insert and run arbitrary code. ABB requires, as noted in previous security advisories and user documentation, that ASPECT should not be exposed to the internet or any other insecure network. Note: In order to exploit an ASPECT, an attacker would need a misconfigured system.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot ncsc_nl NVD CVE.org MITRE

published 2024-12-05modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan