ABB’s Building Management Blunder: A Comedy of Script Errors
ABB Cylon’s Aspect software has a bug that lets savvy hackers in on a prank: by tinkering with the “host” parameter, they can execute an authenticated stored cross-site scripting attack. It’s like inviting hackers to a dinner party, with your browser as the main course.
Hot Take:
ABB’s building management system is managing more than just your energy — it’s also hosting a surprise XSS party! Talk about ‘smart’ devices, huh? The real energy usage here might just be in trying to patch this exploit before your building’s data turns into a hacker’s playground. Remember, folks, it’s all fun and games until someone scripts an alert box on your dashboard!
Key Points:
- ABB’s ASPECT building management systems have been found vulnerable to a stored cross-site scripting (XSS) attack.
- The vulnerability affects several series, including NEXUS, MATRIX-2, ASPECT-Enterprise, and ASPECT-Studio.
- Input to the ‘host’ POST parameter is improperly sanitized, allowing execution of arbitrary HTML/JS code.
- The issue exists in firmware versions <=3.08.02.
- Discovered by Gjoko ‘LiquidWorm’ Krstic, the vulnerability is documented under CVE-2024-6516.
Already a member? Log in here