What’s Vulnerable › Vulnerabilities

CVE-2023-0636: Remote Code Execution via Command Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-05 · updated 2026-06-17
• Weakness: CWE-77

Description

Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Command Injection.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.0; NEXUS Series: from 3.0;0 before 3.07.0; MATRIX Series: from 3.0;0 before 3.07.1.

Affected products

• ABB Aspect-Ent-12 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Aspect-Ent-256 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Aspect-Ent-2 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Aspect-Ent-96 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Matrix-11 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Matrix-216 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Matrix-232 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Matrix-264 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Matrix-296 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-2128-A Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-2128-F Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-2128-G Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-2128 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-264-A Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-264-F Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-264-G Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-264 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-3-2128 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01
• ABB Nexus-3-264 Firmware: from 3.0.0 before 3.07.01 — fixed in 3.07.01

How to fix

Upgrade to a fixed version: ABB Aspect-Ent-12 Firmware 3.07.01; ABB Aspect-Ent-256 Firmware 3.07.01; ABB Aspect-Ent-2 Firmware 3.07.01; ABB Aspect-Ent-96 Firmware 3.07.01; ABB Matrix-11 Firmware 3.07.01; ABB Matrix-216 Firmware 3.07.01; ABB Matrix-232 Firmware 3.07.01; ABB Matrix-264 Firmware 3.07.01; ABB Matrix-296 Firmware 3.07.01; ABB Nexus-2128-A Firmware 3.07.01; ABB Nexus-2128-F Firmware 3.07.01; ABB Nexus-2128-G Firmware 3.07.01. Check the vendor advisory for mitigations.

References

• https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch
• https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch

Get alerted when CVE-2023-0636 or the next vulnerability affects your stack