CVE-2024-13946: CVE-2024-13946: DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the …
Unknown · · NVD published 2025-05-23 · posted 2025-05-25 · last modified 2026-06-17
What it is
DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
| Weakness | CWE-427 |
|---|---|
| CVSS vector | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (source: [email protected]) |
| ATT&CK tactics | Execution → Stealth |
Exploitation evidence
First exploit evidence seen: 2025-05-25 (earliest date across the sources below).
Exploited in the wild
No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).
Public exploit code
Exploit-DB
- EDB-52306: ABB Cylon Aspect Studio 3.08.03 - Binary Planting (2025-05-25)
Sources: Exploit-DB (OffSec).
Defend the Chain
The attack chain for CVE-2024-13946 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.
Pick a red technique card on the board, then choose the defence that stops it.
Defend against T1574.001 DLL Inferred
Inferred from CWE CWE-427
How to fix it
Fixed versions
NVD does not list a fixed version for this CVE. Use the vendor advisory below.
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
No vendor-tagged reference yet; see the full reference list.
MITRE ATT&CK mitigations for this chain
- M1038 Execution Prevention (for T1574.001) : Identify and block potentially malicious software executed through DLL hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software.
- M1044 Restrict Library Loading (for T1574.001) : Disallow loading of remote DLLs. This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+. Enable Safe DLL Search Mode to move the user's current folder later in the search order. This is included by default in modern versions of Windows; the associated Windows Registry ke
- M1051 Update Software (for T1574.001) : Update software regularly to include patches that fix DLL side-loading vulnerabilities.
- M1047 Audit (for T1574.001) : Use auditing tools capable of detecting DLL search order hijacking opportunities on systems within an enterprise and correct them. Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for DLL hijacking weaknesses. Use the program `sxstrace.exe` that is included with Windo
- M1013 Application Developer Guidance (for T1574.001) : When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.
Detection Generic guidance
- Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.