CVE-2024-48845criticalCWE-521

CVE-2024-48845: critical vulnerability in ABB NEXUS Series

Weak Password Rules/Strength

Published

Follow this CVE+ Monitor ASPECT-Enterprise+ Monitor MATRIX Series

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.3epss 1.8%
from disclosure to weapon131 days
Published on NVDDec 5
1st PoC+131d
In short

The affected ABB products allow weak passwords to be set during password reset, making it easier for attackers to gain unauthorized access to admin and application accounts.

Technical detail

CWE-521 vulnerability in ABB ASPECT Enterprise, NEXUS Series, and MATRIX Series v3.07.02 permits weak password configuration during reset operations, enabling brute-force or dictionary attacks against administrative and application interfaces without proper strength enforcement.

Summary generated and translated by AI from the official description.
Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Series v3.07.02
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L
Affected products
ABB · ASPECT-EnterpriseABB · MATRIX SeriesABB · NEXUS Series
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ABB NEXUS Series

In the same product, most dangerous first.

CVE-2024-6298CRITICALremote code executionEPSS 19.0%CVE-2024-6209CRITICALunauthorized file accessEPSS 17.2%CVE-2024-51544HIGHService ControlEPSS 13.2%CVE-2024-48839CRITICALRemote Code Execution, RCEEPSS 2.8%CVE-2024-48840CRITICALUnauthorized AccessEPSS 2.1%CVE-2024-51550CRITICALData Validation / SanitizationEPSS 1.8%