← Vulnerability feed

Vulnerability record · CVE-2023-0636 · published 5 June 2023

CVE-2023-0636: Abb aspect-ent-2 firmware command injection vulnerability

Abb · Aspect Ent 2 Firmware

Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Command Injection.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.0; NEXUS Series: from 3.0;0 before 3.07.0; MATRIX Series: from 3.0;0 before 3.07.1.

9.8 CVSS 3.1 Critical EPSS 1.4% · top 29.4% CWE-77 · Command injection
9.8CVSS 3.1 base score
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
19Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Command Injection.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.0; NEXUS Series: from 3.0;0 before 3.07.0; MATRIX Series: from 3.0;0 before 3.07.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

19 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory
https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch Vendor Advisory

Track CVE-2023-0636 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-0635Abb aspect-ent-2 firmware vulnerabilityImproper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203…EPSS 0.37%9.4CVE-2024-6209Abb aspect-ent-12 firmware vulnerabilityUnauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access …EPSS 17%9.4CVE-2024-6298Abb aspect-ent-12 firmware vulnerabilityUnauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute…EPSS 19%9.3CVE-2024-51547Abb aspect-ent-2 firmware hard-coded credentials vulnerabilityUse of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: throu…EPSS 0.62%9.3CVE-2024-6516Abb aspect-ent-2 firmware cross-site scripting vulnerabilityCross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser.  Affected products…EPSS 1.1%9.3CVE-2024-51549Abb aspect-ent-12 firmware path traversal vulnerabilityAbsolute File Traversal vulnerabilities allows access and modification of un-intended resources.  Affected products: ABB ASPECT - Enterprise v3.08.02…EPSS 0.54%9.3CVE-2024-51550Abb aspect-ent-12 firmware vulnerabilityData Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  Affected pr…EPSS 1.8%9.3CVE-2024-51551Abb aspect-ent-2 firmware hard-coded credentials vulnerabilityDefault Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected products: …EPSS 0.45%

Source: NIST National Vulnerability Database (record CVE-2023-0636), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.