CVE-2024-4007
Published: 01 July 2024
Summary
CVE-2024-4007 is a high-severity Use of Default Credentials (CWE-1392) vulnerability in Abb Aspect-Ent-12 Firmware. Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-4007 is a use of default credentials vulnerability (CWE-1392) present in the installation package for ABB ASPECT, NEXUS Series, and MATRIX Series version 3.07. The flaw allows login to product instances that remain in a misconfigured state after deployment, carrying a CVSS 4.0 score of 8.7 with adjacent-network attack vector and no required privileges or user interaction.
An attacker able to reach the affected systems on an adjacent network can leverage the hardcoded credentials to authenticate and obtain full control over confidentiality, integrity, and availability of the device. Exploitation requires only that the default credentials have not been changed from those supplied in the install package.
The associated ABB advisory is referenced at https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A6101&LanguageCode=en&DocumentPartId=&Action=Launch. The EPSS score has reached a peak of 0.0953 with a current value of 0.0719; no public reports of active exploitation are included in the supplied data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-32573
Vulnerability details
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates replacement of default credentials during secure configuration and provisioning procedures.
Policy requires changing or avoiding default credentials during system setup and operation.
Unique identification requirement prevents use of default or shared credentials by organizational users.
Changing default authenticators prior to first use prevents use of default credentials.
Standards-compliant authentication mechanisms typically prohibit default credentials for cryptographic modules.
Consistent implementation of the strategy drives removal or mitigation of default credentials in procured systems and services.
Security functional requirements and acceptance criteria can stipulate that acquired systems must not use default credentials.
Documentation of known configuration vulnerabilities and secure setup practices reduces reliance on default credentials.