Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2024-4007Hard coded default credential contained in install package

Description

Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list an Exploit-DB entry for it.

Show the exploits1

Exploit-DB1 entry

Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from

Timeline

  1. ID reserved

    By ABB

  2. · 2 months later

    Published

  3. · 31 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-4007, by who scored it
Scored byCVSSScoreVector
ABBCNA (assigner)4.0High8.7CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Red
ABBCNA (assigner)3.1High8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed4.0High8.7CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Red
EPSS (exploitation in 30 days)
1.5% · top 25% of all CVEs (13 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Affected products

What to do

Solution: ABB Strongly recommends the following actions on any released SW version of ASPECT: - Change the PHPmyAdmin Password according to the system manual:  All customers who operate the ASPECT System with its default password are recommended to replace this default password with a unique, secure password, containing a mix of characters, numbers, and special characters with at least 10 characters in length. - Never expose open ports to the ASPECT product towards the Internet or any insecure network. - When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices. - ABB recommends that customers shall apply the latest product update at the earliest convenience.

Workaround: ASPECT system shall not be connected directly to untrusted networks such as the Internet. If remote access to an ASPECT system is a customer requirement, the system shall operate behind a firewall. User accessing ASPECT remotely shall do this using a VPN Gateway allowing access to the particular network segment where ASPECT is installed and configured in. Note: it is crucial that the VPN Gateway and Network is setup in accordance with best industry standards and maintained in terms of security patches for all related components. Any default credentials shall be exchanged with a unique credential supporting adequate strength.

References

References1

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-4007 badge
[![CVE-2024-4007](https://cveledger.app/badge/CVE-2024-4007.svg)](https://cveledger.app/cve/CVE-2024-4007)

Record last updated .