CVE-2024-13955 Overview
CVE-2024-13955 is a second-order SQL injection vulnerability affecting ABB building automation products. The flaw allows authenticated administrators to access and manipulate database repositories through crafted input that executes when later retrieved from storage. The vulnerability impacts the ASPECT-Enterprise, NEXUS Series, and MATRIX Series product lines through version 3.x. Exploitation requires compromised administrator credentials, but successful attacks yield full read and write access to backend database repositories. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Critical Impact
An authenticated attacker with administrator credentials can read, modify, or delete database repository contents used by ABB building automation controllers.
Affected Products
- ABB ASPECT-Enterprise through 3.x
- ABB NEXUS Series through 3.x
- ABB MATRIX Series through 3.x
Discovery Timeline
- 2025-05-22 - CVE-2024-13955 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13955
Vulnerability Analysis
CVE-2024-13955 is classified as a second-order SQL injection flaw. Unlike first-order injection, the malicious payload is stored in the database during one request and executed during a later query. The injected input passes initial validation because the vulnerable SQL context is not the storage query. When a subsequent operation retrieves and concatenates the stored value into a new SQL statement, the payload executes against the database engine.
The affected ABB ASPECT, NEXUS, and MATRIX platforms are used in building management and energy control environments. Successful exploitation gives an attacker direct access to configuration data, credentials, and operational parameters stored in database repositories. Because the products control physical building systems, database tampering can extend beyond data theft into operational disruption.
Root Cause
The root cause is missing parameterization when stored values are later composed into SQL statements. Input that is safe to persist becomes unsafe when concatenated into query strings without escaping or prepared statement binding. ABB has not published detailed code-level information for this issue.
Attack Vector
The attack is network-based and requires valid administrator credentials on the affected device. An attacker submits crafted input through an administrative interface. The payload is stored and later executed by a downstream SQL query, giving the attacker control over the database context. Refer to the ABB security advisory for vendor-specific details on affected endpoints.
Detection Methods for CVE-2024-13955
Indicators of Compromise
- Unexpected administrator logins to ASPECT, NEXUS, or MATRIX management interfaces from unusual IP addresses or outside normal working hours.
- Database entries containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences in fields that should hold plain configuration values.
- Application or database error messages referencing malformed SQL syntax triggered during routine repository reads.
Detection Strategies
- Monitor administrative HTTP requests to ABB building automation controllers for parameters containing SQL keywords or encoded injection payloads.
- Correlate database error events with prior administrator write operations to identify stored payloads triggering on later reads.
- Baseline normal administrator behavior and alert on deviations in configuration change frequency or repository access patterns.
Monitoring Recommendations
- Enable verbose authentication and audit logging on all ASPECT, NEXUS, and MATRIX devices and forward logs to a centralized SIEM.
- Track integrity of database repository tables using periodic hashing or change auditing to detect unauthorized modifications.
- Alert on any use of administrator accounts from network segments that do not normally manage building automation systems.
How to Mitigate CVE-2024-13955
Immediate Actions Required
- Rotate all ABB ASPECT, NEXUS, and MATRIX administrator credentials and enforce strong, unique passwords.
- Restrict network access to management interfaces to trusted engineering workstations and jump hosts only.
- Review recent administrator activity logs for signs of credential compromise or anomalous configuration changes.
Patch Information
ABB has published guidance for this vulnerability. Consult the ABB security advisory document for fixed versions and remediation instructions applicable to ASPECT-Enterprise, NEXUS Series, and MATRIX Series products through the 3.x branch.
Workarounds
- Place affected devices behind a firewall and block administrative interfaces from untrusted networks and the public internet.
- Enforce multi-factor authentication on any bastion or VPN used to reach ABB building automation systems.
- Segment operational technology networks from corporate IT to reduce the blast radius if administrator credentials are compromised.
# Example firewall rule restricting ASPECT management access to an engineering subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
