2013 matches found
ABB Cylon FLXeon 9.3.4 (cert.js) System Logs Information Disclosure
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
ABB Cylon FLXeon 9.3.4 cert.js System Logs Information Disclosure
ABB Cylon FLXeon version 9.3.4 has an issue where an authenticated attacker can access sensitive information via the system logs page of ABB Cylon FLXeon controllers. The logs expose critical data, including the OpenSSL password for stored certificates. This information can be leveraged for furth...
ABB Cylon FLXeon 9.3.4 (app.js) Insecure CORS Configuration
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
ABB Cylon FLXeon 9.3.4 Cross Site Request Forgery
ABB Cylon FLXeon version 9.3.4 suffers from a cross site request forgery vulnerability. However, exploitation is limited to specific conditions due to the server's CORS configuration. !-- ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery RCE Vendor: ABB Ltd. Product web page:...
ABB Cylon FLXeon 9.3.4 Limited Cross-Site Request Forgery (RCE)
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability
ABB Cylon Aspect version 3.08.02 is vulnerable to session fixation, allowing an attacker to set a predefined PHPSESSID value. An attacker can leverage an unauthenticated reflected cross site scripting vulnerability in jsonProxy.php to inject a crafted request, forcing the victim to adopt a fixate...
ABB Cylon FLXeon 9.3.4 serialConfig.js Denial of Service Exploit
ABB Cylon FLXeon version 9.3.4 is vulnerable to an authenticated JSON flooding attack, leading to uncontrolled resource consumption and a denial-of-service DoS condition. The /api/serialConfig endpoint allows an authenticated attacker to abuse an unrestricted loop to create a large number of JSON...
ABB System 800xA ๅฎๅ จๆผๆด
ABB System 800xA is a distributed control system from ABB Switzerland for the industrial control industry. ABB System 800xA has a security vulnerability that originates from storing camera passwords in clear text, which allows an attacker to stop or manipulate the video feed. The affected version...
ABB Cylon Aspect 3.08.02 PHP Session Fixation
ABB Cylon Aspect version 3.08.02 is vulnerable to session fixation, allowing an attacker to set a predefined PHPSESSID value. An attacker can leverage an unauthenticated reflected cross site scripting vulnerability in jsonProxy.php to inject a crafted request, forcing the victim to adopt a fixate...
ABB Cylon FLXeon 9.3.4 serialConfig.js Denial of Service
ABB Cylon FLXeon version 9.3.4 is vulnerable to an authenticated JSON flooding attack, leading to uncontrolled resource consumption and a denial-of-service DoS condition. The /api/serialConfig endpoint allows an authenticated attacker to abuse an unrestricted loop to create a large number of JSON...
The vulnerability of microprogrammed software for programmable logic controllers ABB FBXi, FBVi, FBTi, and CBXi lies in the lack of origin verification in WebSockets. This allows attackers to circumvent security restrictions and gain unauthorized access to protected information.
The vulnerability of microprogrammed programmable logic controllers ABB FBXi, FBVi, FBTi, and CBXi is related to the lack of origin verification in WebSockets. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected...
ABB Cylon FLXeon 9.3.4 runtimeSetup.sh Hidden Backdoor Account Vulnerability
ABB Cylon FLXeon version 9.3.4 has a hidden administrative account cxpro that has write access permissions to the device. ABB Cylon FLXeon 9.3.4 runtimeSetup.sh Hidden Backdoor Account Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FBXi Series, FBTi...
ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability
Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB Cylon Aspect BMS/BAS controller is vulnerable to session...
ABB Cylon FLXeon 9.3.4 wsConnect.js WebSocket Command Spawning Exploit
ABB Cylon FLXeon version 9.3.4 is vulnerable to an unauthenticated WebSocket implementation that allows an attacker to execute the tcpdump command. This command captures network traffic and filters it on serial ports 4855 and 4851, which are relevant to the device's services. The vulnerability ca...
CVE-2024-51547
Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.; NEXUS Series: through 3.; MATRIX Series: through 3...
ABB Cylon FLXeon 9.3.4 (serialConfig.js) JSON Object Flooding DoS
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
ABB Cylon FLXeon 9.3.4 (wsConnect.js) WebSocket Command Spawning PoC
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...
ABB Cylon FLXeon 9.3.4 wsConnect.js WebSocket Command Spawning
ABB Cylon FLXeon version 9.3.4 is vulnerable to an unauthenticated WebSocket implementation that allows an attacker to execute the tcpdump command. This command captures network traffic and filters it on serial ports 4855 and 4851, which are relevant to the device's services. The vulnerability ca...
ABB Cylon FLXeon 9.3.4 runtimeSetup.sh Hidden Backdoor Account
ABB Cylon FLXeon version 9.3.4 has a hidden administrative account cxpro that has write access permissions to the device. ABB Cylon FLXeon 9.3.4 runtimeSetup.sh Hidden Backdoor Account Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon Series FBXi Series, FBTi...
ABB Cylon FLXeon 9.3.4 (runtimeSetup.sh) Hidden Backdoor Account
Summary BACnetยฎ Smart Building Controllers. ABB's BACnet portfolio features a series of BACnetยฎ IP and BACnet MS/TP field controllers for ASPECTยฎ and INTEGRAโข building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...