ABB Cylon’s Hilarious Misstep: When Building Management Systems Go Rogue
The ABB Cylon Aspect BMS/BAS controller has a vulnerability that lets authenticated attackers inject arbitrary content through the webServerDeviceLabelUpdate.php script. By exploiting the deviceLabel POST parameter, they can potentially cause a denial of service. So, it’s like your building management system decided to take a permanent coffee break!
Hot Take:
Well, well, well, look what we have here! ABB Cylon Aspect might be winning awards for energy management, but it’s also winning the “Most Likely to be Exploited” award with this juicy vulnerability. Who needs seamless access to building data when you can seamlessly bring down the whole system with just a few keystrokes? Time to patch things up, ABB, before someone writes more than just “Hello World” into your system!
Key Points:
- ABB Cylon Aspect has an authenticated arbitrary content injection vulnerability.
- The vulnerability is found in the webServerDeviceLabelUpdate.php script.
- Exploitation allows writing arbitrary content to a specific file path, causing a potential DoS.
- Affected versions include NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, and ASPECT-Studio Firmware up to version 3.08.03.
- Discovered by cybersecurity researcher Gjoko ‘LiquidWorm’ Krstic.