CVE-2024-4007: Hard coded default credential contained in install package

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-07-01 · updated 2026-06-17
Weakness: CWE-1392

Description

Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

Affected products

ABB Aspect-Ent-12 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Aspect-Ent-256 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Aspect-Ent-2 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Aspect-Ent-96 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Matrix-11 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Matrix-216 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Matrix-232 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Matrix-264 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Matrix-296 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Nexus-2128 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Nexus-264 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Nexus-3-2128 Firmware: before 3.07.02 — fixed in 3.07.02
ABB Nexus-3-264 Firmware: before 3.07.02 — fixed in 3.07.02

How to fix

Upgrade to a fixed version: ABB Aspect-Ent-12 Firmware 3.07.02; ABB Aspect-Ent-256 Firmware 3.07.02; ABB Aspect-Ent-2 Firmware 3.07.02; ABB Aspect-Ent-96 Firmware 3.07.02; ABB Matrix-11 Firmware 3.07.02; ABB Matrix-216 Firmware 3.07.02; ABB Matrix-232 Firmware 3.07.02; ABB Matrix-264 Firmware 3.07.02; ABB Matrix-296 Firmware 3.07.02; ABB Nexus-2128 Firmware 3.07.02; ABB Nexus-264 Firmware 3.07.02; ABB Nexus-3-2128 Firmware 3.07.02. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-4007 or the next vulnerability affects your stack