ABB Cylon Aspect 3.08.03 Hard-coded Secrets

🗓️ 06 Jan 2025 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 564 Views

ABB Cylon Aspect 3.08.03 has hard-coded secrets, risking unauthorized system access and data exposure.

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the ABB ASPECT-Enterprise system for managing technological processes, as well as the micro-program software used for controllers of the ABB MATRIX and NEXUS series, stems from the use of rigidly encrypted account data. This vulnerability allows a perpetrator to execute arbitrary codes.	10 Feb 202500:00	–	bdu_fstec
Circl	CVE-2024-51547	6 Feb 202504:19	–	circl
CNNVD	ABB多款产品信任管理问题漏洞	6 Feb 202500:00	–	cnnvd
CVE	CVE-2024-51547	6 Feb 202504:12	–	cve
Cvelist	CVE-2024-51547 Credentials Disclosure - keys	6 Feb 202504:12	–	cvelist
EUVD	EUVD-2024-45734	3 Oct 202520:07	–	euvd
ICS	ABB ASPECT-Enterprise NEXUS and MATRIX Series	5 Feb 202500:30	–	ics
NVD	CVE-2024-51547	6 Feb 202505:15	–	nvd
OSV	CVE-2024-51547	6 Feb 202505:15	–	osv
Positive Technologies	PT-2025-5799 · Abb · Aspect-Enterprise +2	5 Feb 202500:00	–	ptsecurity

<html><body><p>ABB Cylon Aspect 3.08.03 Hard-coded Secrets


Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
                  Firmware: &lt;=3.08.03

Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.

Desc: The ABB Cylon Aspect BMS/BAS controller contains multiple instances
of hard-coded credentials, including usernames, passwords, and encryption
keys embedded in various java classes. This practice poses significant security
risks, allowing attackers to gain unauthorized access and compromise the
system's integrity.

Tested on: GNU/Linux 3.15.10 (armv7l)
           GNU/Linux 3.10.0 (x86_64)
           GNU/Linux 2.6.32 (x86_64)
           Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
           Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
           PHP/7.3.11
           PHP/5.6.30
           PHP/5.4.16
           PHP/4.4.8
           PHP/5.3.3
           AspectFT Automation Application Server
           lighttpd/1.4.32
           lighttpd/1.4.18
           Apache/2.2.15 (CentOS)
           OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
           OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
           ErgoTech MIX Deployment Server 2.0.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2025-5896
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5896.php


21.04.2024

--


$ cat project

                 P   R   O   J   E   C   T

                        .|
                        | |
                        |'|            ._____
                ___    |  |            |.   |' .---"|
        _    .-'   '-. |  |     .--'|  ||   | _|    |
     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
     |' | |.    |    ||       | |   |  |    ||      |
 ____|  '-'     '    ""       '-'   '-.'    '`      |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░  
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
         ░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░ 
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░ 
         ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
         ░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░ 


$ cat secrets.txt

- SynchronizedSecurityServicesHandler.class -&gt; CrET8MEbraME4ahu
- MapInvisibleSchedule.class                -&gt; calendar:user
- WDSupervisor.class                        -&gt; aamservletuser:kakideco
- AESCipher2.class                          -&gt; uajo4nzibb$#1E4V5262b17f-c3d5-4190-a442-6d251f9da52b
- AESCipher.class                           -&gt; default
- BrokerURL.class                           -&gt; aamuser:default
- Schedule.class                            -&gt; calendar:user
- BfUtils.class                             -&gt; CrET8MEbraME4ahu
- Context.class                             -&gt; \037jchabucos:friske
- Db.class                                  -&gt; matrixac1:aam
</p></body></html>

06 Jan 2025 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

CVSS 49.3

EPSS0.00595

SSVC