CVE-2024-6516: ABB ASPECT Enterprise XSS Vulnerability

CVE-2024-6516 Overview

CVE-2024-6516 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting ABB building management and control systems. The flaw allows attackers to inject malicious scripts that execute in the context of a client browser session. ABB ASPECT Enterprise, NEXUS Series, and MATRIX Series products running firmware version 3.08.02 are affected. Because these devices are commonly deployed in operational technology (OT) environments for HVAC, lighting, and energy management, successful exploitation can pivot from a browser session into control of building automation workflows. The vulnerability is network-reachable and requires no authentication or privileges.

Critical Impact
An unauthenticated attacker can inject arbitrary JavaScript into the web management interface, enabling session hijacking, credential theft, and unauthorized configuration changes on ABB building automation controllers.

Affected Products

ABB ASPECT Enterprise (ASPECT-Ent-2, ASPECT-Ent-12, ASPECT-Ent-96, ASPECT-Ent-256) firmware v3.08.02
ABB NEXUS Series (NEXUS-2128, NEXUS-2128-A/F/G, NEXUS-264, NEXUS-264-A/F/G, NEXUS-3-2128, NEXUS-3-264) firmware v3.08.02
ABB MATRIX Series (MATRIX-11, MATRIX-216, MATRIX-232, MATRIX-264, MATRIX-296) firmware v3.08.02

Discovery Timeline

2024-12-05 - CVE-2024-6516 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6516

Vulnerability Analysis

The vulnerability resides in the web-based management interface exposed by ABB ASPECT, NEXUS, and MATRIX controllers. User-controlled input is reflected or stored within HTML responses without adequate output encoding or sanitization. An attacker can craft a request containing JavaScript payloads that the browser then renders and executes when a legitimate operator loads the affected page.

Because the platform serves as the control plane for building automation, script execution in an operator's session can be used to read displayed sensor data, submit configuration changes, or exfiltrate authenticated session tokens. The device operates as a network-accessible HTTP service, which broadens the exposure to any attacker able to reach the management interface.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Input received via HTTP parameters, form fields, or stored records is written directly into the response DOM. The affected firmware lacks contextual encoding for HTML, attribute, and JavaScript contexts, allowing <script> tags and event handler attributes to survive server-side processing intact.

Attack Vector

Exploitation is network-based and unauthenticated. An attacker delivers a crafted URL or forces the target to visit a page that submits malicious content to a vulnerable endpoint. When an operator loads the resulting page in the management console, the injected script executes with the operator's session privileges. In building management deployments, this can lead to unauthorized changes to HVAC setpoints, alarm suppression, or lateral movement into adjacent OT segments.

No verified proof-of-concept code has been published. Refer to the ABB Security Document for vendor-supplied technical details.

Detection Methods for CVE-2024-6516

Indicators of Compromise

HTTP requests to ASPECT, NEXUS, or MATRIX management endpoints containing <script>, javascript:, onerror=, or onload= payloads in query strings, form fields, or headers.
Unexpected outbound connections from operator workstations to attacker-controlled domains shortly after loading device management pages.
Unauthorized configuration changes on building controllers with no corresponding legitimate operator activity in audit logs.

Detection Strategies

Inspect web server access logs on ABB devices for URL-encoded or Base64-encoded script fragments in parameter values.
Deploy web application firewall (WAF) or IDS signatures targeting reflected XSS patterns aimed at the ASPECT/NEXUS/MATRIX web interface paths.
Correlate browser process telemetry on operator endpoints with visits to controller IP addresses to identify anomalous script execution or credential prompts.

Monitoring Recommendations

Enable full HTTP request/response logging on the management interface and forward logs to a central SIEM for retention and search.
Monitor administrative and configuration audit trails on ABB controllers for changes made outside approved change windows.
Alert on any external network access to controller management ports; these interfaces should not be reachable from untrusted networks.

How to Mitigate CVE-2024-6516

Immediate Actions Required

Restrict access to the ASPECT, NEXUS, and MATRIX web management interface to a dedicated OT management VLAN and jump hosts only.
Require operators to access the management console from hardened, dedicated workstations that do not browse general internet content.
Review the ABB Security Document and apply the vendor-recommended firmware update as soon as it is validated in a test environment.

Patch Information

ABB has published a security advisory covering CVE-2024-6516. Consult the ABB Security Document for the fixed firmware version and upgrade procedure for each affected model. Firmware version 3.08.02 and earlier releases in the same line should be treated as vulnerable until upgraded.

Workarounds

Place affected devices behind a reverse proxy or WAF that filters HTML control characters and script payloads from inbound requests.
Disable or block remote access to the web management interface from any network segment that carries user or corporate traffic.
Enforce Content Security Policy (CSP) headers at an upstream proxy to reduce the impact of injected scripts on operator browsers.

bash

# Example: restrict access to ABB controller management interface via iptables
# Replace 10.10.20.0/24 with your dedicated OT management subnet
# Replace 192.168.50.10 with the controller IP
iptables -A FORWARD -p tcp -d 192.168.50.10 --dport 443 \
  -s 10.10.20.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.50.10 --dport 443 -j DROP
iptables -A FORWARD -p tcp -d 192.168.50.10 --dport 80 -j DROP