PT-2025-22541 · Aspect · Matrix Series+2

CVE-2024-13954 · Published 2025-05-22 · Updated 2025-05-22

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ASPECT-Enterprise versions through 3.* NEXUS Series versions through 3.* MATRIX Series versions through 3.*

Description The issue concerns the disclosure of serialized configuration information during device commissioning when using ASPECT's configuration toolset.

Recommendations For ASPECT-Enterprise versions through 3., consider restricting access to the configuration toolset until a fix is available. For NEXUS Series versions through 3., avoid using the configuration toolset for device commissioning until the issue is resolved. For MATRIX Series versions through 3.*, limit the use of the configuration toolset to minimize the risk of information disclosure.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2024-13954

Affected Products

Aspect-Enterprise

Matrix Series

Nexus Series

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-13954 · Security Note
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A0021&LanguageCode=en&DocumentPartId=pdf&Action=Launch · Note
• https://twitter.com/CVEnew/status/1925625054865273099 · Twitter Post