Details of VAR-202505-2599

ID

VAR-202505-2599

CVE

CVE-2024-13929

TITLE

ABB products Servlet injection vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-13771

DESCRIPTION

Servlet injection vulnerabilities in ASPECT allow remote code execution if session administrator credentials become compromised. This issue affects ASPECT-Enterprise: through 3.08.03; NEXUS Series: through 3.08.03; MATRIX Series: through 3.08.03. ABB ASPECT-Enterprise is a scalable building energy management and control solution. ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications

Trust: 1.44

sources: NVD: CVE-2024-13929 // CNVD: CNVD-2025-13771

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-13771

AFFECTED PRODUCTS

vendor:	abb	model:	aspect-enterprise	scope:	lte	version:	<=3.08.03	Trust: 0.6
vendor:	abb	model:	nexus series	scope:	lte	version:	<=3.08.03	Trust: 0.6
vendor:	abb	model:	matrix series	scope:	lte	version:	<=3.08.03	Trust: 0.6

sources: CNVD: CNVD-2025-13771

CVSS

SEVERITY

CVSSV2

CVSSV3

cybersecurity@ch.abb.com:	CVE-2024-13929
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2025-13771
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-13771
severity:	HIGH
baseScore:	8.3
vectorString:	AV:N/AC:L/AU:M/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	MULTIPLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.4
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cybersecurity@ch.abb.com:	CVE-2024-13929
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2025-13771 // NVD: CVE-2024-13929

PROBLEMTYPE DATA

problemtype:

CWE-94

Trust: 1.0

sources: NVD: CVE-2024-13929

PATCH

title:

Patch for ABB products Servlet injection vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/702296

Trust: 0.6

sources: CNVD: CNVD-2025-13771

EXTERNAL IDS

db:	NVD	id:	CVE-2024-13929	Trust: 1.6
db:	CNVD	id:	CNVD-2025-13771	Trust: 0.6

sources: CNVD: CNVD-2025-13771 // NVD: CVE-2024-13929

REFERENCES

url:	https://search.abb.com/library/download.aspx?documentid=9akk108471a0021&languagecode=en&documentpartid=pdf&action=launch	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2024-13929	Trust: 0.6

sources: CNVD: CNVD-2025-13771 // NVD: CVE-2024-13929

SOURCES

db:	CNVD	id:	CNVD-2025-13771
db:	NVD	id:	CVE-2024-13929

LAST UPDATE DATE

2025-06-27T23:01:51.207000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-13771	date:	2025-06-26T00:00:00
db:	NVD	id:	CVE-2024-13929	date:	2025-05-23T15:55:02.040

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-13771	date:	2025-06-26T00:00:00
db:	NVD	id:	CVE-2024-13929	date:	2025-05-22T18:15:39.660