CVE-2024-13929: ASPECT Servlet Injection RCE Vulnerability

CVE-2024-13929 Overview

CVE-2024-13929 is a servlet injection vulnerability affecting ABB ASPECT building management systems. The flaw allows remote code execution when session administrator credentials become compromised. The issue is classified under [CWE-94] (Improper Control of Generation of Code) and impacts multiple product lines used in industrial and commercial building automation.

Attackers holding valid administrator session credentials can inject code through servlet endpoints. Successful exploitation grants full control over the host running the ASPECT platform. The vulnerability carries an EPSS probability of 0.582%.

Critical Impact
Authenticated attackers with compromised administrator credentials can achieve remote code execution on ASPECT, NEXUS, and MATRIX Series devices through servlet injection.

Affected Products

ABB ASPECT-Enterprise through version 3.08.03
ABB NEXUS Series through version 3.08.03
ABB MATRIX Series through version 3.08.03

Discovery Timeline

2025-05-22 - CVE-2024-13929 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13929

Vulnerability Analysis

The vulnerability resides in the servlet handling logic of the ASPECT platform. Attackers who obtain administrator session credentials can inject code that the servlet container executes on the underlying operating system. This turns a credential compromise into full system takeover.

ASPECT, NEXUS, and MATRIX Series are building energy management and control products. Compromise of these systems can disrupt HVAC, lighting, and access control processes. The attacker gains the privileges of the process running the affected servlet.

The network attack vector requires the management interface to be reachable by the attacker. Deployments exposing the ASPECT web interface to untrusted networks face the highest exposure. Confidentiality, integrity, and availability of the affected host are all impacted.

Root Cause

The root cause is improper control of code generation within servlet request handling, mapped to [CWE-94]. User-supplied input reaches a servlet component that treats input as executable logic rather than data. The absence of input validation and sandboxing on privileged endpoints enables the injection.

Attack Vector

Exploitation requires network access and valid administrator credentials. An attacker first compromises session administrator credentials through phishing, credential reuse, brute force, or a separate authentication bypass. The attacker then submits crafted requests to injectable servlet endpoints on the ASPECT web interface.

The injected payload executes in the servlet context, allowing arbitrary commands on the host. See the ABB security advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-13929

Indicators of Compromise

Unexpected child processes spawned by the ASPECT servlet or Java runtime on affected devices.
Outbound network connections from ASPECT, NEXUS, or MATRIX hosts to unfamiliar external destinations.
Administrator session logins from unusual source IP addresses or at abnormal hours.
New files, scripts, or binaries appearing in servlet working directories.

Detection Strategies

Monitor web server access logs for unusual POST requests to servlet endpoints containing shell metacharacters or code fragments.
Baseline expected administrator session activity and alert on deviations in source, frequency, or endpoint access.
Inspect process trees on ASPECT hosts for command interpreters (sh, bash, cmd.exe) descending from the servlet container.
Correlate authentication events with subsequent configuration changes or file system modifications.

Monitoring Recommendations

Forward ASPECT, NEXUS, and MATRIX system logs to a centralized SIEM for retention and correlation.
Enable audit logging for all administrator session activity, including servlet requests and configuration changes.
Monitor network segments containing building management systems for lateral movement toward IT assets.

How to Mitigate CVE-2024-13929

Immediate Actions Required

Restrict network access to ASPECT, NEXUS, and MATRIX management interfaces to trusted administrative networks only.
Rotate all administrator credentials and enforce strong, unique passwords across affected devices.
Review administrator session logs for signs of prior compromise before applying fixes.
Apply the vendor-supplied firmware update referenced in the ABB advisory.

Patch Information

ABB has published guidance in document 9AKK108471A0021. Operators of ASPECT-Enterprise, NEXUS Series, and MATRIX Series running versions through 3.08.03 must upgrade to a fixed release as directed by the vendor advisory. Consult ABB support for the appropriate firmware version for each deployed model.

Workarounds

Place affected devices behind a firewall or VPN and block all inbound access from the internet.
Segment building management networks from corporate IT and OT production networks.
Disable or remove unused administrator accounts and limit privileged access to a minimum set of operators.
Enforce multi-factor authentication on any jump host or bastion used to reach the ASPECT web interface.

bash

# Example firewall rule to restrict access to the ASPECT management interface
# Allow only the administrative subnet 10.10.20.0/24 to reach TCP/443 on the device
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP