CVE-2024-51544: ABB ASPECT Firmware Auth Bypass Flaw

CVE-2024-51544 Overview

CVE-2024-51544 affects ABB ASPECT building automation controllers, including the ASPECT-Enterprise, NEXUS, and MATRIX product lines running firmware version 3.08.02. The vulnerability resides in the device's Service Control functionality and allows remote, unauthenticated attackers to access service restart requests and virtual machine (VM) configuration settings. Successful exploitation can disrupt automation services and alter runtime configuration on building management controllers. The flaw is network-exploitable, requires no privileges, and no user interaction, making exposed devices particularly attractive to attackers targeting operational technology (OT) environments. The vulnerability is mapped to [CWE-15] (External Control of System or Configuration Setting).

Critical Impact
Unauthenticated network attackers can restart services and modify VM configuration on ABB ASPECT, NEXUS, and MATRIX devices, leading to operational disruption of building automation systems.

Affected Products

ABB ASPECT-Enterprise (ASPECT-ENT-2, ASPECT-ENT-12, ASPECT-ENT-96, ASPECT-ENT-256) firmware v3.08.02
ABB NEXUS Series (NEXUS-264, NEXUS-2128, including -A/-F/-G variants and NEXUS-3-264, NEXUS-3-2128) firmware v3.08.02
ABB MATRIX Series (MATRIX-11, MATRIX-216, MATRIX-232, MATRIX-264, MATRIX-296) firmware v3.08.02

Discovery Timeline

2024-12-05 - CVE-2024-51544 published to NVD
2025-04-10 - Last updated in NVD database

Technical Details for CVE-2024-51544

Vulnerability Analysis

The vulnerability stems from inadequate access control on the Service Control interface exposed by ABB ASPECT, NEXUS, and MATRIX controllers. Remote attackers can interact with administrative endpoints used to trigger service restart operations and read or modify the underlying VM configuration parameters. Because the affected functionality governs runtime services on the controllers, abuse leads to availability impact on building automation processes such as HVAC, lighting, and energy management. The issue is classified under [CWE-15], which covers external control of configuration settings that should be restricted to authorized administrators. The EPSS score of 13.5% places this issue in the 95th percentile, indicating elevated exploitation likelihood relative to most CVEs.

Root Cause

The Service Control endpoints lack sufficient authentication and authorization checks. Configuration parameters that influence VM behavior and service lifecycle are reachable over the network without the credential validation that should gate privileged operations. This design oversight allows external entities to influence settings that are intended to be administrator-only.

Attack Vector

An attacker reaches the affected device over the network, typically via HTTP/HTTPS exposed on the management interface. The attacker sends crafted requests to the Service Control functionality to issue restart commands or alter VM configuration values. No credentials, prior foothold, or user interaction are required. Exposure is highest where ASPECT controllers are reachable from the internet or untrusted internal networks.

No verified public exploitation code was available at the time of writing. Refer to the ABB security advisory for vendor-supplied technical details.

Detection Methods for CVE-2024-51544

Indicators of Compromise

Unexpected service restart events or VM configuration changes recorded in ABB ASPECT, NEXUS, or MATRIX device logs.
HTTP/HTTPS requests targeting Service Control endpoints from non-administrative source IP addresses.
Anomalous availability gaps or reboots affecting building automation controllers without a scheduled maintenance window.

Detection Strategies

Inspect controller web server logs for unauthenticated requests to service restart and configuration URIs.
Correlate device reboot or service-restart events with network flow data to identify the originating client.
Baseline normal management traffic to the controllers and alert on deviations involving administrative endpoints.

Monitoring Recommendations

Forward syslog and HTTP access logs from ABB controllers to a centralized SIEM for retention and correlation.
Monitor north-south and east-west traffic to OT segments for any access from corporate or external networks.
Track firmware version inventory and flag any device still running ASPECT firmware v3.08.02 or earlier.

How to Mitigate CVE-2024-51544

Immediate Actions Required

Identify all ABB ASPECT-Enterprise, NEXUS, and MATRIX controllers running firmware v3.08.02 and confirm their network exposure.
Remove direct internet exposure of management interfaces and restrict access to a dedicated OT management VLAN.
Apply the firmware update referenced in the ABB security advisory as soon as it is available for your hardware variant.

Patch Information

ABB has published a security advisory covering the ASPECT, NEXUS, and MATRIX product lines affected by CVE-2024-51544. Customers should consult the vendor advisory for fixed firmware versions and upgrade instructions specific to each model. The advisory is available via the ABB Document Download portal.

Workarounds

Place affected controllers behind a firewall that blocks all inbound traffic except from explicitly trusted management hosts.
Disable remote access to the controllers' web management interfaces if remote administration is not required.
Require VPN access with multi-factor authentication for any remote administration of building automation systems.
Segment OT and IT networks so that compromise of a workstation does not grant direct reachability to controllers.

bash

# Example firewall rule restricting management access to ABB ASPECT controllers
# Allow only the dedicated management subnet to reach HTTPS on the controller
iptables -A FORWARD -s 10.50.10.0/24 -d 10.20.0.0/16 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.0.0/16 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 10.20.0.0/16 -p tcp --dport 80 -j DROP