CVE-2024-13951: ASPECT Information Disclosure Vulnerability

CVE-2024-13951 Overview

CVE-2024-13951 is a cryptographic weakness affecting ABB building automation controllers. The flaw stems from the use of a one-way hash function combined with a predictable salt, classified under [CWE-760]. An attacker with low privileges and network access can exploit this weakness to recover sensitive information protected by the affected hashing routine. The issue impacts the ASPECT-Enterprise, NEXUS Series, and MATRIX Series product lines through version 3.*.

Critical Impact
Predictable salt values reduce the entropy of stored hashes, enabling attackers to precompute rainbow tables or accelerate offline cracking to expose credentials or other sensitive data.

Affected Products

ABB ASPECT-Enterprise through version 3.*
ABB NEXUS Series through version 3.*
ABB MATRIX Series through version 3.*

Discovery Timeline

2025-05-22 - CVE-2024-13951 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13951

Vulnerability Analysis

The vulnerability resides in the hashing implementation used by ABB ASPECT-Enterprise, NEXUS Series, and MATRIX Series building automation controllers. These products apply a one-way hash function to protect sensitive values, but combine that hash with a salt that is predictable rather than randomly generated. Predictable salts defeat one of the primary purposes of salting, which is to force attackers to attack each hash independently.

When the salt can be guessed or derived, an attacker who obtains hash values can precompute lookup tables or run parallel offline attacks efficiently. This makes credential recovery and other information disclosure feasible even without a fast hashing weakness. The attack requires network access and low-privileged authentication on the affected system.

Root Cause

The root cause is classified as [CWE-760] Use of a One-Way Hash with a Predictable Salt. The affected firmware fails to generate cryptographically random, per-value salts for hashed sensitive data. Instead, the salt is derived from a value an attacker can predict, reproduce, or observe, which undermines the entropy that salting is intended to add.

Attack Vector

Exploitation is remote and requires low-privileged authentication. An attacker with valid credentials on the controller network can retrieve hash material through legitimate interfaces, then reverse the hashes offline using knowledge of the predictable salt. Successful exploitation yields disclosure of sensitive data protected by the flawed routine.

No verified proof-of-concept code is publicly available. See the ABB Technical Document for vendor-supplied technical details.

Detection Methods for CVE-2024-13951

Indicators of Compromise

Unusual authenticated API or web interface requests that enumerate account records or configuration blobs containing hashed values.
Repeated low-privilege sessions from a single source retrieving password or key material from ASPECT, NEXUS, or MATRIX endpoints.
Outbound transfers of controller configuration exports to non-administrative hosts.

Detection Strategies

Inspect controller access logs for authenticated users pulling hash-bearing resources outside of routine administrative activity.
Baseline expected management traffic to ABB controllers and alert on deviations, especially from operator-tier accounts.
Correlate credential-reuse patterns across the OT network that could indicate cracked hashes being replayed on adjacent systems.

Monitoring Recommendations

Forward controller and jump-host logs to a centralized SIEM for retention and correlation.
Monitor for lateral movement from OT segments toward IT identity infrastructure following any anomalous ASPECT/NEXUS/MATRIX access.
Track configuration file access events and flag any download by non-engineering accounts.

How to Mitigate CVE-2024-13951

Immediate Actions Required

Apply the vendor-supplied firmware update referenced in the ABB Technical Document.
Rotate all credentials stored on ASPECT-Enterprise, NEXUS Series, and MATRIX Series devices, since existing hashes may already be recoverable.
Restrict network access to controllers so only authorized engineering workstations can reach management interfaces.

Patch Information

ABB has published guidance covering the ASPECT, NEXUS, and MATRIX product lines in the referenced technical document. Operators should upgrade beyond the affected 3.* branch to a fixed release as identified by the vendor advisory, then verify integrity of stored credentials after the upgrade.

Workarounds

Place affected controllers behind a segmented OT firewall with strict allow-lists limiting management access to a small set of hosts.
Enforce strong, unique passwords on all controller accounts to raise the cost of offline cracking even where hashes remain weak.
Disable or restrict any accounts that do not require access to sensitive configuration endpoints exposing hash material.

bash

# Example: restrict management access to ABB controller with iptables
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP