CVE-2024-9639

highpriority · track · 0EPSS 0.007 · 52 %ileCHEUNL

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.68% (52nd) EPSS

CVSS 8 · high

Is it mine?

14 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · abb_psirt · ncsc_nl

EPSS · scored 2026-10-27

Remote Code Execution vulnerabilities are present in ASPECT if session administra-tor credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedASP-ENT-xabb_psirt
The vulnerabilities have been resolved in the following product versions: 3.08.04 and later.
FixedMAT-xabb_psirt
The vulnerabilities have been resolved in the following product versions: 3.08.04 and later.
FixedNEX-2xabb_psirt
The vulnerabilities have been resolved in the following product versions: 3.08.04 and later.
FixedNEXUS-3-xabb_psirt
The vulnerabilities have been resolved in the following product versions: 3.08.04 and later.

cvss

Technical severity, 0–10. One row per scoring source.

8.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.8–8

v3.18highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · cybersecurity@ch.abb.comexploitability 1.3 · impact 6

v3.18highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · ABB PSIRT

v3.18highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

v4.07.5highCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/V:Csecondary · ENISA EU

v4.07.5highCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:X/U:Xsecondary · cybersecurity@ch.abb.com

v4.04.8mediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USCWE-94USCWE-94US

affected products (14)

Products and version ranges known to be affected.

ABB 3.08.04all versionsfixedabb_psirtCH
ABB ASP-ENT-x≤ 3.08.03abb_psirtCH
ABB MAT-x≤ 3.08.03abb_psirtCH
ABB MAT-xall versionsfixedabb_psirtCH
ABB NEX-2x≤ 3.08.03abb_psirtCH
ABB NEX-2xall versionsfixedabb_psirtCH
ABB NEXUS-3-xall versionsfixedabb_psirtCH
ABB NEXUS-3-x≤ 3.08.03abb_psirtCH
ABB ASPECT-Enterprise≤ 0 ≤3.08.03enisa_euvdEU
ABB MATRIX Series≤ 0 ≤3.08.03enisa_euvdEU
ABB NEXUS Series≤ 0 ≤3.08.03enisa_euvdEU
ABB ASPECT-Enterprise≤ vers:unknown/<=3.08.03ncsc_nlNL
ABB MATRIX Series≤ vers:unknown/<=3.08.03ncsc_nlNL
ABB NEXUS Series≤ vers:unknown/<=3.08.03ncsc_nlNL

advisories (2)

Vendor and ecosystem advisories describing this.

9AKK108471A0021ELSB/BLBA ASPECT advisory several CVEs2025-05-22csaf · abb_psirtCH
ABB became aware of vulnerabilities in ASPECT product versions listed as affected in the advisory. The earliest report dates to June 2023. ABB has fixed most of the vulnerabilities reported. At the moment there are no plans of corrective measures for remaining vulnerabilities in the affected products. ASPECT is an on-premise Building Management System (BMS) that provides an additional option to be remotely accessible. In order to support customers’ demand for cloud connectivity, ABB has decided to replace ASPECT and will introduce customers to a new solution based on the latest Industry level cyber security standards. The new solution will bring HW and SW capabilities that reflect state-of-the-art technology and is delivered including a maintenance plan that offers customers the best planning security. Customers who have concerns about continuing the operation of ASPECT may contact ABB sales service to become advised about further support options.
NCSC-2025-0177Kwetsbaarheden verholpen in ABB ASPECT-productlijnNL2025-05-23csaf · ncsc_nlNL
ABB heeft kwetsbaarheden verholpen in de ASPECT-productlijn, inclusief ASPECT-Enterprise, NEXUS Series en MATRIX Series tot versie 3.08.03.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd abb_psirt ncsc_nl NVD CVE.org MITRE

published 2025-05-22modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan