When Guest Privileges Throw a Party: ABB Cylon Aspect’s Root Escalation Fiasco!
The ABB Cylon Aspect 3.08.03 firmware has an amusingly named exploit, “Guest2Root Privilege Escalation.” It lets an attacker with valid credentials escalate privileges from a mere guest to the almighty root. If your building energy management system starts acting like it’s on a power trip, it might just be this exploit at work!
Hot Take:
ABB’s BMS/BAS systems are in hot water, and it seems like their security is as stable as a Jenga tower in a windstorm. When your guest login has more power than a superhero, it might be time to reconsider the access policies. ABB might want to start thinking about a new slogan: “Seamless Access… for EVERYONE!”
Key Points:
– ABB’s Cylon Aspect 3.08.03 systems have a critical Guest2Root vulnerability.
– Exploit involves using a crafted .bsx file to gain root access.
– Affected products include NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, and ASPECT-Studio.
– Vulnerability allows authenticated users to execute arbitrary code.
– Discovered by Gjoko ‘LiquidWorm’ Krstic, the vulnerability impacts several Linux distributions and PHP versions.