For awareness Medium Check exposure in your normal cycle
ABB ASPECT building management system has PHP flaws allowing code execution
ABB PSIRTABB · building automation
What happened. ABB reported PHP vulnerabilities in ASPECT versions listed in its advisory. An attacker could run arbitrary code. ABB is still investigating. Exploitation needs a misconfigured system, as ASPECT should not face the internet.
Who is affected. Users of ABB ASPECT, an on-premises building management system (BMS). The extract does not list the affected versions.
What to do. Check whether you run ABB ASPECT, confirm it is not exposed to the internet or other unsecured networks, and follow ABB's documented instructions.
When to act. For awareness: no known exploitation and no score stated
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: ASPECT is an on-premises building management system, which is a supervisory and site-level system.
- Are you exposed?
Check the asset inventory for ASPECT devices and test whether any are reachable from the internet or an unsecured network.
- If you cannot fix it yet
- Remove any internet or unsecured-network access to ASPECT devices.
- Limit remote access to ASPECT to known hosts through a firewall or a VPN with multi-factor authentication.
- Watch for
- Connections to ASPECT devices from the internet or from unexpected networks.
- Unexpected code execution or new files on ASPECT devices.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: ABB PSIRT (opens search.abb.com)
More on ABB Building automation