Hard coded default credential contained in install package
Priority MEDIUM 43CWE-1392Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01511 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ABB | ASPECT Enterprise (ASP-ENT-x) | 3.07 | — | No fix listed | CNA |
| ABB | NEXUS Series (NEX-2x, NEXUS-3-x) | 3.07 | — | No fix listed | CNA |
| ABB | MATRIX Series(MAT-x) | 3.07 | — | No fix listed | CNA |
- ASPECT Enterprise (ASP-ENT-x) VendorABB Affected 3.07 Fixed in — No fix listed CNA
- NEXUS Series (NEX-2x, NEXUS-3-x) VendorABB Affected 3.07 Fixed in — No fix listed CNA
- MATRIX Series(MAT-x) VendorABB Affected 3.07 Fixed in — No fix listed CNA
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:abb:aspect-ent-12_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:aspect-ent-12:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:aspect-ent-2_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:aspect-ent-2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:aspect-ent-256_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:aspect-ent-256:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:aspect-ent-96_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:aspect-ent-96:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:matrix-11_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-11:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
- cpe:2.3:o:abb:aspect-ent-12_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:aspect-ent-12:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:aspect-ent-2_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:aspect-ent-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:aspect-ent-256_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:aspect-ent-256:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:aspect-ent-96_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:aspect-ent-96:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:matrix-11_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-11:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:abb:matrix-216_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-216:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:matrix-232_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-232:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:matrix-264_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:matrix-296_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-296:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-2128_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-2128:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-264_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-3-2128_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-3-2128:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-3-264_firmware:*:*:*:*:*:*:*:* | before 3.07.02 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-3-264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
- cpe:2.3:o:abb:matrix-216_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-216:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:matrix-232_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-232:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:matrix-264_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:matrix-296_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-296:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-2128_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-2128:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-264_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-3-2128_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-3-2128:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-3-264_firmware:*:*:*:*:*:*:*:* Versions before 3.07.02 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-3-264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4007
- 2026-10-03 Alias added: GHSA-cf63-g2wm-56wp
References
More ABB Aspect-ent-12 Firmware vulnerabilities
- TI-2024-05845 Remote code execution in ABB ASPECT-Enterprise CVSS 4.0CRITICAL 9.4
- TI-2024-34459 Service control in ABB ASPECT-Enterprise CVSS 4.0HIGH 8.8
- TI-2024-05758 unauthorized file access CVSS 4.0CRITICAL 9.4
- TI-2024-32539 Remote code execution, RCE in ABB ASPECT-Enterprise CVSS 4.0CRITICAL 9.3
- TI-2024-34465 Data Validation / Sanitization CVSS 4.0CRITICAL 9.3
- TI-2024-32545 Weak Password Rules/Strength CVSS 4.0CRITICAL 9.3
Sources
- CVE-2024-4007 · CVE Program
- CVE-2024-4007 · NVD
- FIRST EPSS
- GHSA-cf63-g2wm-56wp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences