ABB Cylon Aspect Vulnerability: When Your Building Management System Becomes an Unwanted Stand-Up Comedian
The ABB Cylon Aspect 3.08.02 system is so open, you could drive a bus through it! Thanks to a flaw in deployStart.php, even your grandma can initiate server madness with a single click—no experience required. So, buckle up and prepare for unauthorized server initialization and performance issues like never before!
Hot Take:
ABB’s Cylon Aspect BMS/BAS controller is the new VIP at the hackers’ party, and it’s not even on the guest list! This unauthenticated command execution vulnerability is like leaving your front door wide open with a “Free Pizza Inside” sign—except instead of pizza, it’s your critical building management system data. Time to shut the door and fix the locks, ABB!
Key Points:
- ABB Cylon Aspect has an unauthenticated command execution vulnerability.
- The vulnerability is due to the deployStart.php script.
- This allows unauthorized execution of ‘rundeploy.sh’, potentially causing server issues.
- It affects multiple versions and hardware, including NEXUS and MATRIX-2 Series.
- Discovered by Gjoko ‘LiquidWorm’ Krstic, it is recorded under CVE-2024-48840.
Already a member? Log in here