← Advisories

ABB Cylon Aspect 3.08.02 (deployStart.php) Unauthenticated Command Execution

Critical

Advisory ID

ZSL-2024-5891

Release Date

30 December 2024

Vendor

ABB Ltd. - https://www.global.abb

Affected Version

NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio, Firmware: <=3.08.02

CVE

CVE-2024-48840

Tested On

GNU/Linux 3.15.10 (armv7l), GNU/Linux 3.10.0 (x86_64), GNU/Linux 2.6.32 (x86_64), Intel(R) Atom(TM) Processor E3930 @ 1.30GHz, Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz, PHP/7.3.11, PHP/5.6.30, PHP/5.4.16, PHP/4.4.8, PHP/5.3.3, AspectFT Automation Application Server, lighttpd/1.4.32, lighttpd/1.4.18, Apache/2.2.15 (CentOS), OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64), OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode), ErgoTech MIX Deployment Server 2.0.0

Summary

ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices.

Description

The ABB Cylon Aspect BMS/BAS controller suffers from an unauthenticated shell command execution vulnerability through the deployStart.php script. This allows any user to trigger the execution of 'rundeploy.sh' script, which initializes the Java deployment server that sets various configurations, potentially causing unauthorized server initialization and performance issues.

Proof of Concept

abb_aspect_rce19.txtTXT

Disclosure Timeline

21.04.2024Vulnerability discovered.

22.04.2024Vendor contacted.

22.04.2024Vendor responds.

02.05.2024Working with the vendor.

03.12.2024Vendor releases version 3.08.03 to address this issue.

30.12.2024Coordinated public security advisory released.

Credits

Vulnerability discovered by Gjoko Krstic

References