CVE-2024-51548: ABB ASPECT-ENT-12 RCE Vulnerability

CVE-2024-51548 Overview

CVE-2024-51548 is a dangerous file upload vulnerability affecting ABB building automation controllers in the ASPECT, NEXUS, and MATRIX product families. The flaw permits an authenticated attacker with low privileges to upload malicious scripts to affected devices over the network. Successful exploitation compromises confidentiality, integrity, and availability of the device. The weakness is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
An attacker with valid low-privilege credentials can upload executable scripts to ABB ASPECT, NEXUS, and MATRIX v3.08.02 devices, leading to arbitrary code execution on internet-facing building automation systems.

Affected Products

ABB ASPECT - Enterprise v3.08.02 (aspect-ent-2, aspect-ent-12, aspect-ent-96, aspect-ent-256)
ABB NEXUS Series v3.08.02 (nexus-264, nexus-2128 and A/F/G variants, nexus-3-264, nexus-3-2128)
ABB MATRIX Series v3.08.02 (matrix-11, matrix-216, matrix-232, matrix-264, matrix-296)

Discovery Timeline

2024-12-05 - CVE-2024-51548 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51548

Vulnerability Analysis

The vulnerability resides in the file upload handling logic exposed by the web interface of ABB ASPECT, NEXUS, and MATRIX v3.08.02 devices. The application accepts uploaded files without adequately restricting the file type, extension, or content. As a result, an authenticated attacker can place server-executable scripts into a location where they can be invoked through subsequent HTTP requests.

Because these products are building energy management and control systems, exploitation can pivot from IT-adjacent web access into operational technology (OT) environments. The EPSS score is 0.592% (45.5 percentile), indicating measurable but not widespread exploitation likelihood.

Root Cause

The root cause is missing or inadequate server-side validation of uploaded file types [CWE-434]. The handler does not enforce an allow-list of safe extensions, does not verify MIME type against file content, and stores uploaded files in a path reachable by the web server's script interpreter. Any authenticated user in scope of the upload endpoint can therefore drop a payload the server will later execute.

Attack Vector

The attack vector is network-based and requires low privileges but no user interaction. An attacker authenticates to the device management interface, submits a crafted upload request containing a malicious script payload with an executable extension, and then requests the uploaded resource to trigger execution. Given the high impact ratings on confidentiality, integrity, and availability, an attacker who chains this with weak or default credentials can achieve full device compromise.

No public proof-of-concept or exploit is currently listed for this CVE, and it is not present on the CISA Known Exploited Vulnerabilities catalog. Refer to the ABB Security Document for vendor-specific technical detail.

Detection Methods for CVE-2024-51548

Indicators of Compromise

Unexpected files with server-executable extensions (.php, .jsp, .sh, .cgi) appearing in ASPECT, NEXUS, or MATRIX upload directories.
HTTP POST requests to file upload endpoints originating from unfamiliar internal or external source IPs.
Outbound connections from ABB devices to unknown hosts shortly after upload activity, indicative of a webshell callback.
New or modified accounts on the device management interface without a corresponding change ticket.

Detection Strategies

Baseline normal HTTP traffic to ABB device management interfaces and alert on POST requests carrying multipart file payloads outside maintenance windows.
Inspect web server or reverse proxy logs for successful uploads followed by GET requests to the same filename within a short time window.
Deploy network-based signatures to identify uploads containing common webshell markers (eval(, system(, passthru() targeting ABB device IP ranges.

Monitoring Recommendations

Forward ABB device access and audit logs to a centralized SIEM for correlation with authentication events.
Segment building automation networks and monitor cross-segment traffic to and from ASPECT, NEXUS, and MATRIX controllers.
Track file system changes on affected devices where remote management tooling allows.

How to Mitigate CVE-2024-51548

Immediate Actions Required

Remove ABB ASPECT, NEXUS, and MATRIX v3.08.02 management interfaces from direct internet exposure.
Rotate all local device credentials and disable any default or shared accounts.
Audit upload directories on affected devices for unexpected files and remove any unauthorized content.
Restrict management access to a jump host or bastion within a segmented OT network.

Patch Information

ABB has released guidance in the ABB Security Document. Apply the vendor-supplied firmware update for ASPECT Enterprise, NEXUS Series, and MATRIX Series products as soon as a superseding release beyond v3.08.02 is available in your channel. Verify firmware integrity after update.

Workarounds

Place affected devices behind a firewall that permits management traffic only from a small allow-list of administrative hosts.
Enforce network-layer authentication such as VPN or zero-trust access before reaching device web interfaces.
Disable unused services and interfaces on ABB controllers to reduce the attack surface exposed to authenticated users.
Where feasible, deploy a reverse proxy that inspects and blocks uploads with executable extensions or scriptable MIME types.

bash

# Example iptables restriction limiting management access to a single admin host
iptables -A INPUT -p tcp -s 10.20.30.40 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP