CVE-2023-0636

🗓️ 05 Jun 2023 03:45:09Reported by ABBType

cve🔗 web.nvd.nist.gov👁 53 Views🌐 WEB

CVE-2023-0636 Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise, NEXUS Series, and MATRIX Series allows Command Injection

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	Vulnerability of microprogramming software in embedded network control controllers of building management systems like ASPECT Enterprise, NEXUS Series, and MATRIX Series, due to insufficient validation of input data, allows intruders to execute arbitrary codes.	16 Jun 202300:00	–	bdu_fstec
Circl	CVE-2023-0636	5 Nov 202416:30	–	circl
CNNVD	ABB ASPECT 输入验证错误漏洞	5 Jun 202300:00	–	cnnvd
Cvelist	CVE-2023-0636 Remote Code Execution via Command Injection	5 Jun 202303:45	–	cvelist
EUVD	EUVD-2023-12670	3 Oct 202520:07	–	euvd
NVD	CVE-2023-0636	5 Jun 202304:15	–	nvd
OSV	CVE-2023-0636	5 Jun 202304:15	–	osv
Packet Storm	ABB Cylon Aspect 3.07.00 Remote Code Execution	25 Sep 202400:00	–	packetstorm
Prion	Input validation	5 Jun 202304:15	–	prion
Positive Technologies	PT-2023-3095 · Abb · Aspect-Enterprise Asp-Ent-X +19	1 Jun 202300:00	–	ptsecurity

NVD

Node

abb aspect-ent-2_firmwareRange3.0.0–3.07.01

AND

abb aspect-ent-2Match-

Node

abb aspect-ent-12_firmwareRange3.0.0–3.07.01

AND

abb aspect-ent-12Match-

Node

abb aspect-ent-256_firmwareRange3.0.0–3.07.01

AND

abb aspect-ent-256Match-

Node

abb aspect-ent-96_firmwareRange3.0.0–3.07.01

AND

abb aspect-ent-96Match-

Node

abb nexus-2128_firmwareRange3.0.0–3.07.01

AND

abb nexus-2128Match-

Node

abb nexus-2128-a_firmwareRange3.0.0–3.07.01

AND

abb nexus-2128-aMatch-

Node

abb nexus-2128-g_firmwareRange3.0.0–3.07.01

AND

abb nexus-2128-gMatch-

Node

abb nexus-2128-f_firmwareRange3.0.0–3.07.01

AND

abb nexus-2128-fMatch-

Node

abb nexus-3-2128_firmwareRange3.0.0–3.07.01

AND

abb nexus-3-2128Match-

Node

abb nexus-3-264_firmwareRange3.0.0–3.07.01

AND

abb nexus-3-264Match-

Node

abb nexus-264_firmwareRange3.0.0–3.07.01

AND

abb nexus-264Match-

Node

abb nexus-264-a_firmwareRange3.0.0–3.07.01

AND

abb nexus-264-aMatch-

Node

abb nexus-264-g_firmwareRange3.0.0–3.07.01

AND

abb nexus-264-gMatch-

Node

abb nexus-264-f_firmwareRange3.0.0–3.07.01

AND

abb nexus-264-fMatch-

Node

abb matrix-216_firmwareRange3.0.0–3.07.01

AND

abb matrix-216Match-

Node

abb matrix-232_firmwareRange3.0.0–3.07.01

AND

abb matrix-232Match-

Node

abb matrix-296_firmwareRange3.0.0–3.07.01

AND

abb matrix-296Match-

Node

abb matrix-264_firmwareRange3.0.0–3.07.01

AND

abb matrix-264Match-

Node

abb matrix-11_firmwareRange3.0.0–3.07.01

AND

abb matrix-11Match-

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "2CQG103201S3021",
      "2CQG103202S3021",
      "2CQG103203S3021",
      "2CQG103204S3021"
    ],
    "platforms": [
      "ASPECT®-Enterprise",
      "Linux"
    ],
    "product": "ASPECT®-Enterprise",
    "vendor": "ABB Ltd.",
    "versions": [
      {
        "lessThan": "3.07.0",
        "status": "affected",
        "version": "3.0;0",
        "versionType": "update"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "modules": [
      "2CQG100102R2021",
      "2CQG100104R2021",
      "2CQG100105R2021",
      "2CQG100106R2021",
      "2CQG100110R2021",
      "2CQG100112R2021",
      "2CQG100103R2021",
      "2CQG100107R2021",
      "2CQG100108R2021",
      "2CQG100109R2021",
      "2CQG100111R2021",
      "2CQG100113R2021"
    ],
    "platforms": [
      "NEXUS Series",
      "Linux"
    ],
    "product": "NEXUS Series",
    "vendor": "ABB Ltd.",
    "versions": [
      {
        "lessThan": "3.07.0",
        "status": "affected",
        "version": "3.0;0",
        "versionType": "update"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "modules": [
      "2CQG100102R1021",
      "2CQG100103R1021",
      "2CQG100104R1021",
      "2CQG100105R1021",
      "2CQG100106R1021"
    ],
    "platforms": [
      "MATRIX Series",
      "Linux"
    ],
    "product": "MATRIX Series",
    "vendor": "ABB Ltd.",
    "versions": [
      {
        "lessThan": "3.07.1",
        "status": "affected",
        "version": "3.0;0",
        "versionType": "update"
      }
    ]
  }
]

Source	Link
search	www.search.abb.com/library/Download.aspx

Parameter	Position	Path	Description	CWE
host	query param	networkDiagAjax.php	Unauthenticated OS command injection via host parameter in networkDiagAjax.php	CWE-77

17 Jun 2026 05:25Current

8.4High risk

Vulners AI Score8.4

CVSS 3.17.2 - 9.8

EPSS0.0136

SSVC

CWE-77