CVE-2024-6515: ABB ASPECT Firmware Credential Exposure Flaw

CVE-2024-6515 Overview

CVE-2024-6515 affects ABB building automation controllers across the ASPECT, NEXUS, and MATRIX product lines running firmware version 3.08.02. The web browser interface transmits application usernames and passwords in clear text or Base64 encoding. This design flaw increases the likelihood of unintended credential exposure to network-adjacent attackers. The vulnerability is classified under CWE-319: Cleartext Transmission of Sensitive Information.

Critical Impact
An authenticated network attacker capable of observing or intercepting traffic to the affected controllers can recover application credentials and leverage them to compromise building automation systems.

Affected Products

ABB ASPECT-Enterprise (ASPECT-ENT-2, ASPECT-ENT-12, ASPECT-ENT-96, ASPECT-ENT-256) firmware v3.08.02
ABB NEXUS Series (NEXUS-2128, NEXUS-2128-A/F/G, NEXUS-264, NEXUS-264-A/F/G, NEXUS-3-2128, NEXUS-3-264) firmware v3.08.02
ABB MATRIX Series (MATRIX-11, MATRIX-216, MATRIX-232, MATRIX-264, MATRIX-296) firmware v3.08.02

Discovery Timeline

2024-12-05 - CVE-2024-6515 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6515

Vulnerability Analysis

The affected ABB controllers expose a web management interface used to administer building automation functions. The interface handles authentication material by sending credentials either as clear text or with a reversible Base64 encoding. Base64 is an encoding scheme, not encryption, so any party observing the transmission can trivially recover the original username and password.

An attacker positioned on the same network segment or with access to any intermediary device can capture credentials during login flows or session-establishment operations. Once recovered, the credentials can be replayed against the same interface or reused against related management functions. Because these devices control HVAC, lighting, energy, and access subsystems, credential compromise can cascade into operational impact on physical facility systems.

Root Cause

The underlying defect is a failure to enforce end-to-end confidentiality of authentication material inside the browser-facing management workflow. The application layer does not encrypt credential fields before submission and relies on encoding rather than a cryptographic transport wrapper. Where transport security is not enforced or is misconfigured, the credentials remain readable on the wire.

Attack Vector

Exploitation requires network access to the management interface and the ability to observe traffic destined for the controller. Common preconditions include a foothold on the operational technology (OT) or enterprise VLAN, access to a mirrored port or upstream network device, or man-in-the-middle positioning between an operator workstation and the controller. No memory corruption or complex exploit primitives are required — the attacker only needs to read the credential fields carried in HTTP requests.

No public proof-of-concept exploit is listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. See the ABB security advisory for vendor technical details.

Detection Methods for CVE-2024-6515

Indicators of Compromise

HTTP requests to the ASPECT, NEXUS, or MATRIX management interface carrying Authorization: Basic headers or POST bodies containing Base64-encoded credential fields over unencrypted channels.
Unexpected successful authentications to controllers from workstations or subnets that do not normally administer building automation systems.
Configuration changes on affected controllers immediately following observed cleartext login traffic.

Detection Strategies

Inspect network traffic between operator workstations and controller management interfaces for cleartext or Base64-encoded credentials in HTTP payloads.
Correlate authentication events on the controllers with the source IP addresses and time-of-day patterns of authorized administrators to surface anomalies.
Deploy passive OT network monitoring on the segments hosting ABB ASPECT, NEXUS, and MATRIX devices to flag plaintext HTTP sessions.

Monitoring Recommendations

Alert on any HTTP (port 80) sessions to affected controllers where HTTPS is expected, and on failed TLS negotiations that fall back to cleartext.
Forward controller access logs and network flow records to a central analytics platform for retention and cross-source correlation.
Monitor for lateral movement from workstations that recently authenticated to a controller, especially toward other OT assets.

How to Mitigate CVE-2024-6515

Immediate Actions Required

Restrict access to the ASPECT, NEXUS, and MATRIX web management interfaces to a dedicated management VLAN or jump host, and block all other network paths.
Rotate all application credentials used to administer affected controllers, assuming prior exposure on flat or shared networks.
Disable or firewall unencrypted HTTP access to the management interface and require HTTPS where the firmware supports it.

Patch Information

Refer to the vendor advisory for firmware guidance: ABB Security Advisory 9AKK108469A7497. Apply the firmware release identified by ABB as remediating CVE-2024-6515 and validate that the management interface enforces encrypted transport after upgrade.

Workarounds

Place affected controllers behind a VPN or IPsec tunnel so that credential traffic is protected even if the application layer sends cleartext.
Segment building automation networks from corporate IT and guest networks using firewalls with strict allow-list rules for management traffic.
Limit administrative logins to physically secured operator workstations and disable remote access to the web interface where operationally feasible.

bash

# Example iptables rule to restrict controller management access to a jump host
iptables -A FORWARD -s 10.20.30.40/32 -d 10.50.0.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.50.0.0/24 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.50.0.0/24 -p tcp --dport 443 -j DROP