CVE-2023-0635: abb ltd. aspect®-enterprise Use of Weak Credentials

Vulnerability summary

CVE-2023-0635 is a critical (CVSS 9.8) Use of Weak Credentials vulnerability in abb ltd. aspect®-enterprise. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30.1% of scored vulnerabilities.

Timeline

1. 05-06-2023
   PublishedVulnerability first disclosed.
2. 08-01-2025
   Last modifiedVulnerability information updated.

Description

Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Privilege Escalation.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.01; NEXUS Series: from 3.0;0 before 3.07.01; MATRIX Series: from 3.0;0 before 3.07.01.

• CWE-1391Use of Weak CredentialsThe product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.