ABB’s Building Management Blunder: Reflected XSS Vulnerability Exposed!
ABB Cylon Aspect 3.08.03 has an authenticated reflected XSS vulnerability. It’s like giving a toddler a permanent marker and setting them loose on your walls—unexpected and messy. The unsanitized input in GET parameters can execute arbitrary code in your browser, turning your building management system into a surprise art exhibit.
Hot Take:
ABB Cylon’s Aspect might be the next big thing in energy management, but with its latest vulnerability, it seems like it’s more interested in managing your cookie jar. With a little bit of unsanitized input and a sprinkle of reflected XSS, your browser could be in for a wild ride. Who knew saving energy could be so… electrifying?
Key Points:
- ABB Cylon’s ASPECT solution faces an authenticated reflected XSS vulnerability.
- Vulnerability affects specific GET parameters like ‘name’ and ‘id’.
- Potential for arbitrary HTML/JS code execution in affected user’s browser sessions.
- Tested on various Linux distributions and processor configurations.
- Discovered by Gjoko ‘LiquidWorm’ Krstic, advisory ID ZSL-2025-5897.
Already a member? Log in here