CVE-2024-13931: ASPECT Path Traversal Vulnerability

CVE-2024-13931 Overview

CVE-2024-13931 is a relative path traversal vulnerability affecting ABB ASPECT building management systems. The flaw allows an attacker with compromised session administrator credentials to access file resources outside the intended directory scope. The vulnerability is classified under [CWE-606: Unchecked Input for Loop Condition] and impacts multiple product lines used in industrial and commercial building automation.

Affected products include ASPECT-Enterprise, NEXUS Series, and MATRIX Series running firmware versions through 3.08.03. Successful exploitation exposes confidential file resources and can compromise the integrity and availability of the target system.

Critical Impact
An authenticated attacker with administrator-level credentials can traverse directory structures to read, modify, or delete arbitrary files on affected ABB ASPECT devices.

Affected Products

ABB ASPECT-Enterprise through version 3.08.03
ABB NEXUS Series through version 3.08.03
ABB MATRIX Series through version 3.08.03

Discovery Timeline

2025-05-22 - CVE-2024-13931 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13931

Vulnerability Analysis

The vulnerability resides in file-handling routines within the ASPECT web-based management interface. The application accepts file path parameters without properly normalizing or validating relative path sequences such as ../. An authenticated session administrator can supply crafted path input to reference files outside the intended working directory.

Because ASPECT devices control heating, ventilation, air conditioning, lighting, and energy management, unauthorized file access can expose configuration data, credentials, and operational logic. The attack requires prior compromise of session administrator credentials, which limits opportunistic exploitation but remains realistic in environments with weak credential hygiene or credential reuse.

Root Cause

The root cause is insufficient input sanitization in file resource handlers. The affected components fail to canonicalize user-supplied path components before joining them with a base directory. This omission allows path traversal characters to escape the intended file system boundary and reference sibling or parent directories.

Attack Vector

Exploitation occurs over the network against the ASPECT management interface. The attacker must first obtain valid session administrator credentials through phishing, credential reuse, brute force, or prior compromise. Once authenticated, the attacker submits crafted HTTP requests containing relative path sequences to file resource endpoints. See the ABB Technical Document for vendor-specific details on the affected endpoints.

Detection Methods for CVE-2024-13931

Indicators of Compromise

HTTP requests to ASPECT management endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f
Access to file paths outside the expected application working directory referenced in web server or application logs
Unexpected administrator session activity originating from unusual source IP addresses or during off-hours
File read events targeting sensitive configuration files, credential stores, or system directories

Detection Strategies

Deploy web application firewall rules that inspect HTTP request parameters for path traversal patterns targeting ASPECT endpoints
Correlate authentication events with subsequent file access requests to identify anomalous administrator behavior
Baseline normal file resource request patterns and alert on deviations that reference directories outside the application root
Monitor for repeated failed and successful administrator logins that may indicate credential compromise

Monitoring Recommendations

Enable verbose logging on ASPECT management interfaces and forward logs to a centralized SIEM for correlation
Track privileged session activity, including file access, configuration changes, and download events
Alert on outbound data transfers from ASPECT devices that exceed established baselines
Review administrator account inventory regularly and disable unused or shared credentials

How to Mitigate CVE-2024-13931

Immediate Actions Required

Upgrade ASPECT-Enterprise, NEXUS Series, and MATRIX Series devices to a firmware release later than 3.08.03 as provided by ABB
Rotate all session administrator credentials on affected devices and enforce strong, unique passwords
Restrict network access to ASPECT management interfaces using firewall rules and VLAN segmentation
Audit administrator account activity for signs of prior exploitation or unauthorized file access

Patch Information

ABB has published guidance in the ABB Technical Document. Operators should consult the advisory for the specific fixed firmware version and coordinate deployment with system integrators to avoid disrupting building automation services.

Workarounds

Place ASPECT devices behind a VPN or jump host and block direct internet exposure of management interfaces
Enforce multi-factor authentication on any upstream identity provider that gates access to ASPECT administration
Apply the principle of least privilege by minimizing the number of accounts assigned session administrator roles
Monitor building automation network segments for anomalous HTTP traffic and lateral movement attempts