Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-13951 is a medium-severity Use of a One-Way Hash with a Predictable Salt (CWE-760) vulnerability in Abb (inferred from references). Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54593
Vulnerability Data
One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V6.5.2
Mitigating Controls (NIST 800-53 r5) AI
Cryptographic protection requirements can mandate approved algorithms and parameters that include unpredictable salts for password hashing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce use of unpredictable salts and strong password hashing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of cryptography requires appropriate cryptographic controls including proper salting, largely mitigating predictable-salt weaknesses.
Secure development life cycle includes secure coding practices that would catch predictable-salt usage during design and implementation.
A.8.26 only requires that security requirements (including those derived from risk assessment or referencing 8.24 cryptography) be identified and specified; it does not itself mandate, enforce or implement any specific salt-generation mechanism that would stop a predictable salt from being used or exploited.
A.8.27 mandates establishing and applying security engineering principles (including secure-by-design, least privilege, hardening, and reviews against attack patterns) but does not itself mandate or enforce the use of unpredictable salts in one-way password hashing, so the weakness can still be present and exploitable.
Secure coding explicitly prohibits predictable salts and mandates cryptographically secure random salts.
Security testing in development and acceptance can detect weak password hashing implementations.