ABB Cylon BACnet MS/TP Kernel Module (mstp.ko) Out-of-Bounds Write in SendFrame()

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. BACnet Smart Building Controllers. ABB's BACnet portfolio features a series of...

S3C2 Summit 2024-09: Industry Secure Software Supply Chain Summit

While providing economic and software development value, software supply chains are only as strong as their weakest link. Over the past several years, there has been an exponential increase in cyberattacks, specifically targeting vulnerable links in critical software supply chains. These attacks...

Siemens BACnet ATEC 输入验证错误漏洞

Siemens BACnet ATEC Siemens BACnet Advanced Terminal Equipment Controller is a building automation terminal equipment controller from Siemens, Germany. An input validation error vulnerability exists in Siemens BACnet ATEC that stems from improper handling of certain BACnet MSTP messages, which...

Siemens OZW672 操作系统命令注入漏洞

The OZW device web server is used for remote monitoring of building controller devices, e.g. for monitoring heating control or air conditioning status. A code execution and SQL injection vulnerability exists in the Siemens OZW672 and OZW772 web servers, which can be exploited by an attacker to...

A Refreshment Stirred, Not Shaken (III): Can Swapping Be Differentially Private?

The quest for a precise and contextually grounded answer to the question in the present paper's title resulted in this stirred-not-shaken triptych, a phrase that reflects our desire to deepen the theoretical basis, broaden the practical applicability, and reduce the misperception of differential...

ABB Cylon Aspect 4.00.00 (factorySetSerialNum.php) - Remote Code Execution

Exploit title : ABB Cylon Aspect 4.00.00 factorySetSerialNum.php Remote Code Execution Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =4.00.00 Summary: ASPECT is an award-winning scalable buildi...

Autodesk AutoCAD和Autodesk Revit 缓冲区错误漏洞

Autodesk AutoCAD and Autodesk Revit are both products of Autodesk, Inc. of the U.S.A. Autodesk AutoCAD is a suite of professional 3D drawing software.Autodesk Revit is a suite of building information modeling software. A security vulnerability exists in Autodesk AutoCAD and Autodesk Revit that...

ABB Cylon Aspect 3.08.02 (bbmdUpdate.php) - Remote Code Execution

ABB Cylon Aspect 3.08.02 bbmdUpdate.php - Remote Code Execution Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.02 Summary: ASPECT is an award-winning scalable building energy management an...

ABB Cylon Aspect 3.08.03 (CookieDB) - SQL Injection

ABB Cylon Aspect 3.08.03 CookieDB SQL Injection Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.03 Summary: ASPECT is an award-winning scalable building energy management and control soluti...

ABB Cylon Aspect 3.08.03 - Hard-coded Secrets

ABB Cylon Aspect 3.08.03 Hard-coded Secrets Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.03 Summary: ASPECT is an award-winning scalable building energy management and control solution...

ABB Cylon Aspect 3.08.03 (MapServicesHandler) - Authenticated Reflected XSS

ABB Cylon Aspect 3.08.03 MapServicesHandler - Authenticated Reflected XSS Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.03 Summary: ASPECT is an award-winning scalable building energy...

ABB Cylon Aspect 3.08.02 - PHP Session Fixation

Exploit title: ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability Advisory ID: ZSL-2025-5916 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5916.php CVE ID: CVE-2024-11317 CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-11317 Vendor: ABB Ltd. Product web page:...

Exploit for CVE-2024-44308

cve-2024-44308 Michael Goppert, Michael Jennings, and John...

ABB Cylon Aspect 3.08.01 - Remote Code Execution (RCE)

Exploit Title : ABB Cylon Aspect 3.08.01 - Remote Code Execution RCE Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy manageme...

Cryptocurrency in 2025: Exploring Bitcoin Growth, AI, and the Next Wave of Tools

The cryptocurrency world feels like a wild ride full of risks, twists, and big dreams of building wealth.…...

Exploit for CVE-2025-1974

README Talk is cheap, just look at the code. Detailed can be...

gcc security update

4.8.5-45.0.1 - Orabug: 37603707 ELSA-2025-1601 Moderate: gcc security update CVE-2020-11023 rebuild for CVE-2020-11023 - Reviewed-by: Jose E. Marchesi 4.8.5-44.0.5 - fix arm cross building inline issue. gcc48-cfns-fix-protos.patch - Reviewed-by: Jose E. Marchesi 4.8.5-44.0.3 - Orabug: 31505739...

ABB Cylon FLXeon 9.3.4 Unauthenticated Dashboard Access Vulnerability

ABB Cylon FLXeon version 9.3.4 allows unauthenticated access to the Building Management System BMS or Building Automation System BAS dashboard. This exposes sensitive information, including system status, events, and alarms related to HVAC operations. Additionally, an attacker could manipulate...

ABB Cylon FLXeon 9.3.4 Default Credentials Vulnerability

ABB Cylon FLXeon version 9.3.4 uses a weak set of default administrative credentials that can be guessed in remote password attacks and gain full control of the system. ABB Cylon FLXeon 9.3.4 Default Credentials Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: FLXeon...

CVE-2025-26793

CVE-2025-26793 affects Hirsch Enterphone MESH Web GUI. The default credentials (username: freedom, password: viscount) are not forced to be changed during initial configuration, and changing them is cumbersome. Attackers may use the Internet-facing endpoint mesh.webadmin.MESHAdminServlet to gain ...