CVE-2025-30170: ASPECT Information Disclosure Vulnerability

CVE-2025-30170 Overview

CVE-2025-30170 is an information exposure vulnerability affecting ABB ASPECT-Enterprise, NEXUS Series, and MATRIX Series building automation controllers. The flaw allows an authenticated attacker with compromised administrator session credentials to enumerate file paths, file sizes, and the existence of files on the underlying system. The weakness is classified as [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere) and affects all versions through 3.08.03.

Critical Impact
Attackers who compromise session administrator credentials gain reconnaissance capability over the controller file system, enabling targeted follow-on attacks against operational technology environments.

Affected Products

ABB ASPECT-Enterprise through version 3.08.03
ABB NEXUS Series through version 3.08.03
ABB MATRIX Series through version 3.08.03

Discovery Timeline

2025-05-22 - CVE-2025-30170 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-30170

Vulnerability Analysis

The vulnerability resides in ABB's ASPECT building management platform and the related NEXUS and MATRIX controller series. The affected components fail to restrict responses that expose file system metadata to authenticated administrator sessions. An attacker with valid session credentials can query the system and infer file paths, measure file sizes, and confirm whether specific files exist.

This class of information disclosure does not directly grant code execution or data read access. It does, however, provide attackers with precise reconnaissance that supports lateral movement, targeted exploitation of other vulnerabilities, and the mapping of configuration or credential files for later retrieval. In building automation and operational technology environments, such disclosures assist adversaries in understanding engineering workstations and HMI deployments.

Root Cause

The root cause is improper handling of file-related responses within authenticated endpoints of the ASPECT platform. The application returns distinguishable responses based on file existence and path validity, allowing attackers to iterate over expected locations and build a map of the system. The condition requires high privileges, meaning the attacker must first compromise administrator session credentials through phishing, credential reuse, or session theft.

Attack Vector

The attack is network-based and requires an active administrator session. Once credentials are compromised, the attacker interacts with ASPECT, NEXUS, or MATRIX management interfaces to issue requests that disclose file system structure. No user interaction is required beyond the initial credential compromise. Refer to the ABB Security Advisory for vendor-published technical details.

Detection Methods for CVE-2025-30170

Indicators of Compromise

Unusual administrator session activity on ASPECT, NEXUS, or MATRIX management interfaces, especially from unexpected source IPs or outside business hours.
Repeated or enumerative requests to file-handling endpoints returning differentiated responses based on file existence.
Administrator logins preceded by credential-theft indicators such as phishing clicks or anomalous Entra ID or Active Directory authentication events.

Detection Strategies

Review web server and application logs on ASPECT controllers for high-volume requests to file-related URIs from a single session.
Correlate administrator authentication events with downstream file-system query activity to identify reconnaissance patterns.
Baseline normal administrator workflows and alert on deviations in request frequency or scope.

Monitoring Recommendations

Forward ASPECT, NEXUS, and MATRIX logs to a central SIEM for correlation with identity telemetry.
Monitor privileged account use with alerts on new source addresses, geolocation anomalies, or impossible-travel conditions.
Track configuration changes and session lifetimes on building automation controllers to detect persistence attempts.

How to Mitigate CVE-2025-30170

Immediate Actions Required

Rotate all administrator credentials for ASPECT, NEXUS, and MATRIX systems and invalidate active sessions.
Restrict network access to management interfaces using firewalls, VPN gateways, or OT network segmentation.
Enforce multi-factor authentication for administrator accounts where supported by the deployment architecture.

Patch Information

ABB has published guidance in the ABB Security Advisory. Operators should upgrade ASPECT-Enterprise, NEXUS Series, and MATRIX Series beyond version 3.08.03 once a fixed release is available and verified in a staging environment.

Workarounds

Isolate ASPECT, NEXUS, and MATRIX controllers on dedicated OT VLANs with strict egress and ingress rules.
Disable or limit remote administrator access, allowing management only from jump hosts within a trusted zone.
Implement session timeouts and continuous session validation to limit the window of credential misuse.

bash

# Example firewall rule restricting ASPECT management access to a jump host
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP