📄 ABB Cylon Aspect Studio 3.08.03 Insecure Permissions
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | Several ABB products have security vulnerabilities | 22 May 202500:00 | – | cnnvd |
 | Information Disclosure Vulnerability in Various ABB Products (CNVD-2025-13423) | 17 Jun 202500:00 | – | cnvd |
 | CVE-2024-13948 | 22 May 202518:15 | – | cve |
 | CVE-2024-13948 Insecure Permissions | 22 May 202518:15 | – | cvelist |
 | EUVD-2024-54600 | 3 Oct 202520:07 | – | euvd |
 | CVE-2024-13948 | 22 May 202519:15 | – | nvd |
 | PT-2025-22535 · Unknown +1 · Nexus Series +3 | 22 May 202500:00 | – | ptsecurity |
 | CVE-2024-13948: Incorrect Default Permissions | 22 May 202500:00 | – | rapid7 |
 | CVE-2024-13948 | 24 May 202519:11 | – | redhatcve |
 | CVE-2024-13948 Insecure Permissions | 22 May 202518:15 | – | vulnrichment |
10
ABB Cylon Aspect Studio 3.08.03 Insecure Permissions
Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: <=3.08.03
Summary: ABB Cylon ASPECT Studio is a graphical programming tool and
integrated development environment (IDE) for ABB Cylon ASPECT products.
It's used to engineer comprehensive area control and graphical user interface
(GUI) solutions, containing a library of logical and graphical widgets.
It allows users to monitor and control facilities from anywhere, providing
insights into building performance and enabling timely reactions to issues.
Desc: The application suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the executable
file with a binary of choice. The vulnerability exist due to the improper
permissions, with the 'M' flag (Modify) for 'Authenticated Users' group.
Tested on: Microsoft Windows 10 Home (EN)
OpenJDK 64-Bit Server VM Temurin-21.0.6+7
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2025-5951
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5951.php
CVE ID: CVE-2024-13948
CVE URL: https://www.cve.org/CVERecord/SearchResults?query=CVE-2024-13948
21.04.2024
--
C:\> type project
P R O J E C T
.|
| |
|'| ._____
___ | | |. |' .---"|
_ .-' '-. | | .--'| || | _| |
.-'| _.| | || '-__ | | | || |
|' | |. | || | | | | || |
____| '-' ' "" '-' '-.' '` |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
C:\Aspect\Aspect-Studio-3.08.03>icacls *.jar
AspectStudioObf.jar BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 filesData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
23 May 2025 00:00Current
6.3Medium risk
Vulners AI Score6.3
CVSS 46.9
CVSS 3.17.3
EPSS0.00156
SSVC