CVE-2024-51550
Published: 05 December 2024
Summary
CVE-2024-51550 is a critical-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Abb Aspect-Ent-12 Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 10.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-51550 is a data validation and sanitization vulnerability affecting ABB ASPECT Enterprise, NEXUS Series, and MATRIX Series devices running version 3.08.02. The flaw resides in the Linux-based environment of these Aspect devices and permits injection of unvalidated and unsanitized data.
An unauthenticated attacker with network access can exploit the issue remotely to compromise confidentiality and integrity at a high level while also affecting availability to a lesser degree, as reflected in the CVSS 9.3 rating.
An ABB advisory describing the affected products and recommended actions is available at https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch. The associated EPSS score has remained low, moving only from 0.0475 currently to a peak of 0.0553.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-45754
Vulnerability details
Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.