ABB Cylon Aspect Vulnerability: When Your Building Management System Needs a Babysitter!
The ABB Cylon Aspect 3.08.02 is vulnerable to a PHP session fixation flaw, allowing attackers to dictate session IDs with the precision of a Swiss watchmaker. This could leave users more exposed than a nudist in a snowstorm. An attacker could exploit this vulnerability via an unauthenticated reflected XSS attack.
Hot Take:
Move over, hackers! ABB Cylon Aspect’s session fixation vulnerability is the new “fixation” for cyber troublemakers everywhere. It’s like giving them the keys to your building’s energy management system—except the keys are made of PHP spaghetti code. Who knew energy management could be so electrifyingly vulnerable?
Key Points:
- ABB Cylon Aspect’s building management systems have a session fixation vulnerability.
- This flaw allows attackers to exploit PHPSESSID values, potentially compromising user sessions.
- The vulnerability can be triggered through an unauthenticated reflected XSS in jsonProxy.php.
- Affected products include NEXUS Series, MATRIX-2 Series, and ASPECT-Enterprise, among others.
- Discovered by cyber-superhero Gjoko ‘LiquidWorm’ Krstic at Zero Science Labs.
Already a member? Log in here