ABB Cylon’s Comedy of Errors: Remote Code Execution Leaves Systems Vulnerable
The ABB Cylon Aspect 3.08.02 has a flaw that turns building management into a comedy of errors, with hackers starring as unwanted guests. Thanks to an OS command injection vulnerability, an innocent .db file can become a mischievous prankster, executing commands like a rogue magician. Who knew building energy management could be so electrifyingly entertaining?
Hot Take:
Looks like ABB’s Cylon Aspect system just graduated from managing buildings to hosting a cybersecurity horror show! With a neat little trick, hackers can now take a stroll inside your building’s energy management system, having their way with shell commands. Who knew building management could be this thrillingly dangerous?
Key Points:
- ABB Cylon Aspect BMS/BAS controller has an authenticated OS command injection vulnerability.
- The vulnerability affects several firmware versions, including NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, and ASPECT-Studio.
- Exploitation involves uploading a .db file with malicious commands, bypassing filename sanitization.
- Advisory ID: ZSL-2025-5904 and CVE ID: CVE-2024-48839.
- Discovered by cybersecurity researcher Gjoko ‘LiquidWorm’ Krstic.
Already a member? Log in here