CVE-2024-48846

🗓️ 05 Dec 2024 12:43:20Reported by ABBType

cve🔗 web.nvd.nist.gov👁 87 Views🌐 WEB

Cross Site Request Forgery vulnerabilities in ABB ASPECT, NEXUS Series, and MATRIX Series v3.08.0

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of microprogramming software in embedded network control controllers of ASPECT Enterprise, NEXUS Series, and MATRIX Series systems relates to the possibility of manipulating cross-site requests. This allows attackers to carry out CSRF attacks.	9 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-48846	5 Dec 202413:07	–	circl
CNNVD	ABB ASPECT 安全漏洞	5 Dec 202400:00	–	cnnvd
Cvelist	CVE-2024-48846 Cross Side Request Forgery, CSRF	5 Dec 202412:43	–	cvelist
Exploit DB	ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF)	16 Apr 202500:00	–	exploitdb
EUVD	EUVD-2024-43165	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in ABB ASPECT, NEXUS Series and MATRIX Series	6 Dec 202411:49	–	ncsc
NVD	CVE-2024-48846	5 Dec 202413:15	–	nvd
OSV	CVE-2024-48846	5 Dec 202413:15	–	osv
Positive Technologies	PT-2024-9200 · Abb · Abb Aspect +2	5 Dec 202400:00	–	ptsecurity

NVD

Vulners

Vulnrichment

Node

AND

abb aspect-ent-2_firmwareRange<3.08.03

abb aspect-ent-2Match-

Node

AND

abb aspect-ent-256_firmwareRange<3.08.03

abb aspect-ent-256Match-

Node

AND

abb aspect-ent-96_firmwareRange<3.08.03

abb aspect-ent-96Match-

Node

AND

abb nexus-2128_firmwareRange<3.08.03

abb nexus-2128Match-

Node

AND

abb nexus-2128-a_firmwareRange<3.08.03

abb nexus-2128-aMatch-

Node

AND

abb nexus-2128-f_firmwareRange<3.08.03

abb nexus-2128-fMatch-

Node

AND

abb nexus-2128-g_firmwareRange<3.08.03

abb nexus-2128-gMatch-

Node

AND

abb nexus-264_firmwareRange<3.08.03

abb nexus-264Match-

Node

AND

abb nexus-264-a_firmwareRange<3.08.03

abb nexus-264-aMatch-

Node

AND

abb nexus-264-g_firmwareRange<3.08.03

abb nexus-264-gMatch-

Node

AND

abb nexus-3-2128_firmwareRange<3.08.03

abb nexus-3-2128Match-

Node

AND

abb aspect-ent-12_firmwareRange<3.08.03

abb aspect-ent-12Match-

Node

AND

abb nexus-264-f_firmwareRange<3.08.03

abb nexus-264-fMatch-

Node

AND

abb nexus-3-264_firmwareRange<3.08.03

abb nexus-3-264Match-

Node

AND

abb matrix-11_firmwareRange<3.08.03

abb matrix-11Match-

Node

AND

abb matrix-216_firmwareRange<3.08.03

abb matrix-216Match-

Node

AND

abb matrix-232_firmwareRange<3.08.03

abb matrix-232Match-

Node

AND

abb matrix-264_firmwareRange<3.08.03

abb matrix-264Match-

Node

AND

abb matrix-296_firmwareRange<3.08.03

abb matrix-296Match-

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "ASPECT-Enterprise",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "3.08.02",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "NEXUS Series",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "3.08.02",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "MATRIX Series",
    "vendor": "ABB",
    "versions": [
      {
        "lessThanOrEqual": "3.08.02",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
search	www.search.abb.com/library/Download.aspx

Parameter	Position	Path	Description	CWE
USER	request body	192.168.73.31/userManagement.php	CSRF allowing privileged actions via forged HTTP POST to userManagement.php	CWE-352
PASSWORD	request body	192.168.73.31/userManagement.php	CSRF allowing privileged actions via forged HTTP POST to userManagement.php	CWE-352
ACTION	request body	192.168.73.31/userManagement.php	CSRF allowing privileged actions via forged HTTP POST to userManagement.php	CWE-352
newuser	request body	192.168.73.31:7226/servlet/UserManager	CSRF enabling account creation via forged POST to UserManager servlet	CWE-352
password	request body	192.168.73.31:7226/servlet/UserManager	CSRF enabling account creation via forged POST to UserManager servlet	CWE-352
passwordConfirm	request body	192.168.73.31:7226/servlet/UserManager	CSRF enabling account creation via forged POST to UserManager servlet	CWE-352
Insert	request body	192.168.73.31:7226/servlet/UserManager	CSRF enabling account creation via forged POST to UserManager servlet	CWE-352
user9	request body	192.168.73.31:7226/servlet/UserManager	CSRF enabling deletion via forged POST to UserManager servlet	CWE-352
remove9	request body	192.168.73.31:7226/servlet/UserManager	CSRF enabling deletion via forged POST to UserManager servlet	CWE-352
totalRows	request body	192.168.73.31:7226/servlet/UserManager	CSRF enabling deletion via forged POST to UserManager servlet	CWE-352

17 Jun 2026 07:58Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.1 - 7.3

CVSS 47.1

EPSS0.00656

SSVC

CWE-352