Critical severity · published Jun 5, 2023
CVE-2023-0635
Privilege escalation to root
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Privilege Escalation.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.01; NEXUS Series: from 3.0;0 before 3.07.01; MATRIX Series: from 3.0;0 before 3.07.01.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASPECT®-Enterprise · ABB Ltd.
3.0;0 before 3.07.01 · source: vendor
MS
MATRIX Series · ABB Ltd.
3.0;0 before 3.07.01 · source: vendor
NS
NEXUS Series · ABB Ltd.
3.0;0 before 3.07.01 · source: vendor
AF
Aspect-ent-12 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
AF
Aspect-ent-2 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
AF
Aspect-ent-256 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
AF
Aspect-ent-96 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-11 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-216 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-232 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-264 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
MF
Matrix-296 Firmware · Abb
3.0.0 before 3.07.01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-0635
Vendor Advisory
https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch
More from ASPECT®-Enterprise
9.8
CVE-2023-0636
Remote Code Execution via Command Injection