CVE-2024-4007

🗓️ 01 Jul 2024 12:06:53Reported by ABBType

cve🔗 web.nvd.nist.gov👁 89 Views🌐 WEB

Default credentials allow unauthorized logi

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	ASPECT Enterprise Full Control	9 Oct 202400:00	–	bdu_fstec
Circl	CVE-2024-4007	4 Apr 202521:02	–	circl
CNNVD	Various ABB products Security breaches	1 Jul 202400:00	–	cnnvd
Cvelist	CVE-2024-4007 Hard coded default credential contained in install package	1 Jul 202412:06	–	cvelist
Exploit DB	ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials	3 Apr 202500:00	–	exploitdb
EUVD	EUVD-2024-32573	3 Oct 202520:07	–	euvd
NVD	CVE-2024-4007	1 Jul 202413:15	–	nvd
osv_cve	CVE-2024-4007	1 Jul 202413:15	–	osv_cve
Packet Storm	ABB Cylon Aspect 3.07.01 Hard-Coded Credentials	26 Sep 202400:00	–	packetstorm
Positive Technologies	PT-2024-6673 · Abb · Abb Aspect +2	26 Jun 202400:00	–	ptsecurity

NVD

Vulners

Vulnrichment

Node

AND

abb aspect-ent-12_firmwareRange<3.07.02

abb aspect-ent-12Match-

Node

AND

abb aspect-ent-2_firmwareRange<3.07.02

abb aspect-ent-2Match-

Node

AND

abb aspect-ent-256_firmwareRange<3.07.02

abb aspect-ent-256Match-

Node

AND

abb aspect-ent-96_firmwareRange<3.07.02

abb aspect-ent-96Match-

Node

AND

abb matrix-11_firmwareRange<3.07.02

abb matrix-11Match-

Node

AND

abb matrix-216_firmwareRange<3.07.02

abb matrix-216Match-

Node

AND

abb matrix-232_firmwareRange<3.07.02

abb matrix-232Match-

Node

AND

abb matrix-264_firmwareRange<3.07.02

abb matrix-264Match-

Node

AND

abb matrix-296_firmwareRange<3.07.02

abb matrix-296Match-

Node

AND

abb nexus-2128_firmwareRange<3.07.02

abb nexus-2128Match-

Node

AND

abb nexus-264_firmwareRange<3.07.02

abb nexus-264Match-

Node

AND

abb nexus-3-2128_firmwareRange<3.07.02

abb nexus-3-2128Match-

Node

AND

abb nexus-3-264_firmwareRange<3.07.02

abb nexus-3-264Match-

[
  {
    "collectionURL": "https://new.abb.com/low-voltage/de/produkte/gebaeudeautomation/produktsortiment/cylon/produkte/aspect-enterprise",
    "defaultStatus": "unaffected",
    "packageName": "Installer",
    "platforms": [
      "Linux"
    ],
    "product": "ASPECT Enterprise (ASP-ENT-x)",
    "vendor": "ABB",
    "versions": [
      {
        "status": "affected",
        "version": "3.07"
      }
    ]
  },
  {
    "collectionURL": "https://new.abb.com/low-voltage/de/produkte/gebaeudeautomation/produktsortiment/cylon/produkte/nexus-series",
    "defaultStatus": "unaffected",
    "packageName": "Installer",
    "platforms": [
      "Linux"
    ],
    "product": "NEXUS Series (NEX-2x, NEXUS-3-x)",
    "vendor": "ABB",
    "versions": [
      {
        "status": "affected",
        "version": "3.07"
      }
    ]
  },
  {
    "collectionURL": "https://new.abb.com/low-voltage/de/produkte/gebaeudeautomation/produktsortiment/cylon/produkte/matrix",
    "defaultStatus": "unaffected",
    "packageName": "Installer",
    "platforms": [
      "Linux"
    ],
    "product": "MATRIX Series(MAT-x)",
    "vendor": "ABB",
    "versions": [
      {
        "status": "affected",
        "version": "3.07"
      }
    ]
  }
]

Source	Link
search	www.search.abb.com/library/Download.aspx

Parameter	Position	Path	Description	CWE
controluser	path	max/var/www/html/phpMyAdmin/config.inc.php	Hard-coded credentials stored in phpMyAdmin config.inc.php enabling unauthorized access when the file is exposed.	CWE-1392
controlpass	path	max/var/www/html/phpMyAdmin/config.inc.php	Hard-coded credentials stored in phpMyAdmin config.inc.php enabling unauthorized access when the file is exposed.	CWE-1392

17 Jun 2026 08:00Current

7.9High risk

Vulners AI Score7.9

CVSS 48.7

CVSS 3.18.8

EPSS0.01511

SSVC

CWE-1392