Details of VAR-202505-3718

ID

VAR-202505-3718

CVE

CVE-2024-13952

TITLE

ABB products have code injection vulnerabilities

Trust: 0.6

sources: CNVD: CNVD-2025-13424

DESCRIPTION

Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*. ABB ASPECT-Enterprise is a scalable building energy management and control solution. ABB NEXUS Series is a monitoring and management system. ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ABB products have a code injection vulnerability that may lead to file name prediction attacks due to credential leakage. No detailed vulnerability details are currently available

Trust: 1.44

sources: NVD: CVE-2024-13952 // CNVD: CNVD-2025-13424

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-13424

AFFECTED PRODUCTS

vendor:	abb	model:	aspect-enterprise	scope:	lte	version:	<=3.08.03	Trust: 0.6
vendor:	abb	model:	nexus series	scope:	lte	version:	<=3.08.03	Trust: 0.6
vendor:	abb	model:	matrix series	scope:	lte	version:	<=3.08.03	Trust: 0.6

sources: CNVD: CNVD-2025-13424

CVSS

SEVERITY

CVSSV2

CVSSV3

cybersecurity@ch.abb.com:	CVE-2024-13952
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2025-13424
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-13424
severity:	HIGH
baseScore:	8.3
vectorString:	AV:N/AC:L/AU:M/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	MULTIPLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.4
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cybersecurity@ch.abb.com:	CVE-2024-13952
baseSeverity:	HIGH
baseScore:	8.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.7
impactScore:	6.0
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2025-13424 // NVD: CVE-2024-13952

PROBLEMTYPE DATA

problemtype:

CWE-94

Trust: 1.0

sources: NVD: CVE-2024-13952

PATCH

title:

Patch for ABB products have code injection vulnerabilities

url:

https://www.cnvd.org.cn/patchInfo/show/701781

Trust: 0.6

sources: CNVD: CNVD-2025-13424

EXTERNAL IDS

db:	NVD	id:	CVE-2024-13952	Trust: 1.6
db:	CNVD	id:	CNVD-2025-13424	Trust: 0.6

sources: CNVD: CNVD-2025-13424 // NVD: CVE-2024-13952

REFERENCES

url:

https://search.abb.com/library/download.aspx?documentid=9akk108471a0021&languagecode=en&documentpartid=pdf&action=launch

Trust: 1.6

sources: CNVD: CNVD-2025-13424 // NVD: CVE-2024-13952

SOURCES

db:	CNVD	id:	CNVD-2025-13424
db:	NVD	id:	CVE-2024-13952

LAST UPDATE DATE

2025-06-26T23:27:21.220000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-13424	date:	2025-06-25T00:00:00
db:	NVD	id:	CVE-2024-13952	date:	2025-05-23T15:54:42.643

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-13424	date:	2025-06-25T00:00:00
db:	NVD	id:	CVE-2024-13952	date:	2025-05-22T19:15:39.150