Critical severity · published Dec 5, 2024
CVE-2024-51555
Force Change of Default Credentials
10.0
CVSS
0.4%
EPSS
No
On KEV
Description
Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the installer to change default credentials.
Affected products:
ABB ASPECT - Enterprise v3.07.02;
NEXUS Series v3.07.02;
MATRIX Series v3.07.02
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
ASPECT-Enterprise · ABB
through 3.07.02 · source: vendor
MS
MATRIX Series · ABB
through 3.07.02 · source: vendor
NS
NEXUS Series · ABB
through 3.07.02 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51555
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51555
search.abb.com
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
More from ASPECT-Enterprise
10.0
CVE-2024-51551
Default Credentials
10.0
CVE-2024-11317
PHP Session Fixation
9.9
CVE-2024-6784
SSRF Server Side Request Forgery
9.8
CVE-2024-51547
Credentials Disclosure - keys
9.8
CVE-2024-51554
off-by-one-error