CVE-2024-6209: CVE-2024-6209: Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series …

What it is

Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized

Exploitation evidence

First exploit evidence seen: 2025-04-02 (earliest date across the sources below).

Exploited in the wild

No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).

Public exploit code

Exploit-DB

• EDB-52108: ABB Cylon Aspect 3.08.01 - Arbitrary File Delete (2025-04-02)

Sources: Exploit-DB (OffSec).

How to fix it

Fixed versions

• abb aspect-ent-12 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb aspect-ent-2 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb aspect-ent-256 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb aspect-ent-96 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-2128 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-2128-a firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-2128-f firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-2128-g firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-264 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-264-a firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-264-f firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-264-g firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-3-2128 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb nexus-3-264 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb matrix-11 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb matrix-216 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb matrix-232 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb matrix-264 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.
• abb matrix-296 firmware: versions up to and including 3.08.01 are affected; check the vendor advisory for the fixed release.

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch&_ga=2.39956449.23035250.1719878527-141379670.1701144964 (Vendor Advisory)

Detection Generic guidance

Response checklist Generic guidance

1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.