ABB Nexus-264-g Firmware: vulnerabilities and CVEs

Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.

Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affected products:

Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser. Affected products:

Web browser interface may manipulate application username/password in clear text or Base64 encoding providing a higher probability of unintended credentails exposure. Affected products:

Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products:

Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products:

Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device. Affected products:

Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products:

Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products:

Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products:

Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products:

Service Control vulnerabilities allow access to service restart requests and vm configuration settings. Affected products:

Information Disclosure vulnerabilities allow access to application configuration information. Affected products:

Configuration Download vulnerabilities allow access to dependency configuration information. Affected products:

Local File Inclusion vulnerabilities allow access to sensitive system information. Affected products:

MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affected products:

Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected products:

Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access. Affected products:

Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products:

Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products:

Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products:

Improper Input Validation vulnerability allows Remote Code Execution. Affected products:

Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products:

Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products:

Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely

Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized

Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series,…

Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS…