CVE-2024-6298: ABB ASPECT-ENT-12 Firmware RCE Vulnerability

CVE-2024-6298 Overview

CVE-2024-6298 is an unauthorized file access vulnerability affecting the WEB Server component in ABB ASPECT - Enterprise v3.08.01, NEXUS Series v3.08.01, and MATRIX Series v3.08.01. This vulnerability allows an attacker to execute arbitrary code remotely on affected building automation and energy management systems.

ABB's ASPECT, NEXUS, and MATRIX product lines are widely deployed in industrial and commercial building automation environments, making this vulnerability particularly significant for organizations managing critical infrastructure. The flaw enables attackers with adjacent network access to compromise affected devices without requiring authentication or user interaction.

Critical Impact

Remote code execution capability through unauthorized file access in building automation systems that could lead to complete system compromise and potential disruption of critical infrastructure operations.

Affected Products

• ABB ASPECT-ENT-12, ASPECT-ENT-2, ASPECT-ENT-256, ASPECT-ENT-96 (firmware version 3.08.01 and earlier)
• ABB NEXUS-2128, NEXUS-2128-A, NEXUS-2128-F, NEXUS-2128-G, NEXUS-264, NEXUS-264-A, NEXUS-264-F, NEXUS-264-G, NEXUS-3-2128, NEXUS-3-264 (firmware version 3.08.01 and earlier)
• ABB MATRIX-11, MATRIX-216, MATRIX-232, MATRIX-264, MATRIX-296 (firmware version 3.08.01 and earlier)

Discovery Timeline

• July 5, 2024 - CVE-2024-6298 published to NVD
• December 5, 2024 - Last updated in NVD database

Technical Details for CVE-2024-6298

Vulnerability Analysis

This vulnerability resides in the web server component of ABB's building management systems. The unauthorized file access flaw allows attackers on an adjacent network to access files they should not be permitted to view or manipulate, ultimately enabling arbitrary code execution on the target device.

The vulnerability is classified under CWE-1287 (Improper Validation of Specified Type of Input), indicating that the web server fails to properly validate or restrict the types of files that can be accessed through its interface. This improper validation creates a pathway for attackers to leverage file system access to execute malicious code.

Given the nature of ABB's ASPECT, NEXUS, and MATRIX systems as building automation and energy management platforms, successful exploitation could have significant consequences for physical infrastructure including HVAC systems, lighting controls, and energy monitoring capabilities.

Root Cause

The root cause of CVE-2024-6298 stems from improper input validation in the web server's file handling mechanisms. The web server fails to adequately restrict or validate file access requests, allowing attackers to access arbitrary files on the system. This improper validation of specified input types (CWE-1287) enables attackers to bypass intended access controls and interact with system files that should be protected.

Attack Vector

The attack vector requires adjacent network access, meaning an attacker must be on the same local network segment as the target device. This could be achieved through:

• Physical access to the network where the ABB devices are deployed
• Compromise of another device on the same network segment
• Exploitation of misconfigured network segmentation in industrial environments

Once adjacent network access is obtained, the attacker can exploit the unauthorized file access vulnerability without requiring any authentication credentials or user interaction. The vulnerability has been confirmed to have exploit information available in ExploitDB, indicating active security research and potential weaponization of this flaw.

The exploitation involves sending specially crafted requests to the web server component that bypass file access restrictions, allowing the attacker to read, modify, or upload files that can then be executed on the target system.

Detection Methods for CVE-2024-6298

Indicators of Compromise

• Unusual file access patterns or requests to the ABB device web server from unexpected network sources
• Unexpected modifications to system files or configuration on ASPECT, NEXUS, or MATRIX devices
• Anomalous network traffic originating from building automation systems
• New or modified files in web server directories that were not part of authorized updates

Detection Strategies

• Implement network intrusion detection systems (NIDS) with signatures for abnormal HTTP requests targeting ABB building automation web interfaces
• Monitor ABB device logs for unauthorized file access attempts or unusual web server requests
• Deploy network traffic analysis to detect lateral movement or data exfiltration from building automation network segments
• Establish baseline behavior for ABB devices and alert on deviations in file system activity or network communications

Monitoring Recommendations

• Enable comprehensive logging on all ABB ASPECT, NEXUS, and MATRIX devices and forward logs to a centralized SIEM
• Implement network segmentation monitoring to detect any attempts to access building automation systems from unauthorized network segments
• Configure alerts for any firmware changes or file modifications on affected devices
• Regularly audit network access to building automation systems to ensure proper segmentation is maintained

How to Mitigate CVE-2024-6298

Immediate Actions Required

• Apply the latest firmware updates from ABB as documented in the ABB Security Advisory
• Isolate affected ABB devices on dedicated network segments with strict access controls
• Disable or restrict web server access to affected devices from untrusted network segments
• Implement strong network segmentation between building automation systems and general enterprise networks
• Conduct an immediate audit of all ABB ASPECT, NEXUS, and MATRIX deployments to identify vulnerable firmware versions

Patch Information

ABB has released security guidance and patches for this vulnerability. Organizations should refer to the ABB Technical Document (9AKK108469A7497) for detailed patch information and update procedures. Firmware updates should be applied to all affected ASPECT, NEXUS, and MATRIX series devices running version 3.08.01 or earlier.

Workarounds

• Implement strict network access control lists (ACLs) to limit which hosts can communicate with ABB building automation devices
• Deploy a web application firewall (WAF) in front of ABB device web interfaces to filter malicious requests
• Disable the web server interface on affected devices if it is not operationally required
• Use VPN or jump host architectures to ensure only authorized administrators can access building automation systems
• Consider implementing application-layer firewalls to inspect and filter traffic to the web server component

# Example network segmentation configuration (Cisco IOS)
# Create dedicated VLAN for building automation systems
vlan 100
 name Building_Automation

# Apply ACL to restrict access to building automation VLAN
access-list 100 permit ip 10.0.10.0 0.0.0.255 10.0.100.0 0.0.0.255
access-list 100 deny ip any 10.0.100.0 0.0.0.255 log
access-list 100 permit ip any any

interface Vlan100
 ip address 10.0.100.1 255.255.255.0
 ip access-group 100 in