CVE-2024-48846

🗓️ 05 Dec 2024 12:43:20Reported by ABBType

cve🔗 web.nvd.nist.gov👁 75 Views🌐 WEB

Cross Site Request Forgery vulnerabilities in ABB ASPECT, NEXUS Series, and MATRIX Series v3.08.0

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of microprogramming software in embedded network control controllers of ASPECT Enterprise, NEXUS Series, and MATRIX Series systems relates to the possibility of manipulating cross-site requests. This allows attackers to carry out CSRF attacks.	9 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-48846	5 Dec 202413:07	–	circl
CNNVD	ABB ASPECT 安全漏洞	5 Dec 202400:00	–	cnnvd
Cvelist	CVE-2024-48846 Cross Side Request Forgery, CSRF	5 Dec 202412:43	–	cvelist
Exploit DB	ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF)	16 Apr 202500:00	–	exploitdb
EUVD	EUVD-2024-43165	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in ABB ASPECT, NEXUS Series and MATRIX Series	6 Dec 202411:49	–	ncsc
NVD	CVE-2024-48846	5 Dec 202413:15	–	nvd
OSV	CVE-2024-48846	5 Dec 202413:15	–	osv
Positive Technologies	PT-2024-9200 · Abb · Abb Aspect +2	5 Dec 202400:00	–	ptsecurity

NVD

Node

abb aspect-ent-2_firmwareRange<3.08.03

AND

abb aspect-ent-2Match-

Node

abb aspect-ent-256_firmwareRange<3.08.03

AND

abb aspect-ent-256Match-

Node

abb aspect-ent-96_firmwareRange<3.08.03

AND

abb aspect-ent-96Match-

Node

abb nexus-2128_firmwareRange<3.08.03

AND

abb nexus-2128Match-

Node

abb nexus-2128-a_firmwareRange<3.08.03

AND

abb nexus-2128-aMatch-

Node

abb nexus-2128-f_firmwareRange<3.08.03

AND

abb nexus-2128-fMatch-

Node

abb nexus-2128-g_firmwareRange<3.08.03

AND

abb nexus-2128-gMatch-

Node

abb nexus-264_firmwareRange<3.08.03

AND

abb nexus-264Match-

Node

abb nexus-264-a_firmwareRange<3.08.03

AND

abb nexus-264-aMatch-

Node

abb nexus-264-g_firmwareRange<3.08.03

AND

abb nexus-264-gMatch-

Node

abb nexus-3-2128_firmwareRange<3.08.03

AND

abb nexus-3-2128Match-

Node

abb aspect-ent-12_firmwareRange<3.08.03

AND

abb aspect-ent-12Match-

Node

abb nexus-264-f_firmwareRange<3.08.03

AND

abb nexus-264-fMatch-

Node

abb nexus-3-264_firmwareRange<3.08.03

AND

abb nexus-3-264Match-

Node

abb matrix-11_firmwareRange<3.08.03

AND

abb matrix-11Match-

Node

abb matrix-216_firmwareRange<3.08.03

AND

abb matrix-216Match-

Node

abb matrix-232_firmwareRange<3.08.03

AND

abb matrix-232Match-

Node

abb matrix-264_firmwareRange<3.08.03

AND

abb matrix-264Match-

Node

abb matrix-296_firmwareRange<3.08.03

AND

abb matrix-296Match-

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "ASPECT-Enterprise",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "3.08.02",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "NEXUS Series",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "3.08.02",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "MATRIX Series",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "3.08.02",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
search	www.search.abb.com/library/Download.aspx

Parameter	Position	Path	Description	CWE
USER	request body	192.168.73.31/userManagement.php	CSRF-prone endpoint allowing privileged actions via HTTP POST without validating the request source.	CWE-352
PASSWORD	request body	192.168.73.31/userManagement.php	CSRF-prone endpoint allowing privileged actions via HTTP POST without validating the request source.	CWE-352
ACTION	request body	192.168.73.31/userManagement.php	CSRF-prone endpoint allowing privileged actions via HTTP POST without validating the request source.	CWE-352
newuser	request body	192.168.73.31:7226/servlet/UserManager	CSRF-prone endpoint allowing privileged user management actions via HTTP POST without source validation.	CWE-352
password	request body	192.168.73.31:7226/servlet/UserManager	CSRF-prone endpoint allowing privileged user management actions via HTTP POST without source validation.	CWE-352
passwordConfirm	request body	192.168.73.31:7226/servlet/UserManager	CSRF-prone endpoint allowing privileged user management actions via HTTP POST without source validation.	CWE-352
Insert	request body	192.168.73.31:7226/servlet/UserManager	CSRF-prone endpoint allowing privileged user management actions via HTTP POST without source validation.	CWE-352
user9	request body	192.168.73.31:7226/servlet/UserManager	CSRF-prone endpoint allowing privileged user deletion via HTTP POST without validating the request source.	CWE-352
remove9	request body	192.168.73.31:7226/servlet/UserManager	CSRF-prone endpoint allowing privileged user deletion via HTTP POST without validating the request source.	CWE-352
totalRows	request body	192.168.73.31:7226/servlet/UserManager	CSRF-prone endpoint allowing privileged user deletion via HTTP POST without validating the request source.	CWE-352

17 Jun 2026 07:58Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.1 - 7.3

CVSS 47.1

EPSS0.00643

SSVC

CWE-352