ABB ASPECT BMS/BAS authentication bypass and buffer overflow
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical authentication bypass in ABB ASPECT building management systems allows unauthenticated remote control; patch to 3.08.04-s01.
ABB has released a security advisory for multiple vulnerabilities in its ASPECT, NEXUS, and MATRIX building management and automation systems deployed worldwide across commercial facilities. Three vulnerabilities affect all versions of ASPECT prior to 3.08.04-s01: CVE-2025-53187 is an authentication bypass resulting from debugging code left in production firmware, allowing attackers to change system time, access files, and execute function calls without authentication (CVSS 9.8/9.3); CVE-2025-7679 is a missing authentication flaw for critical functions (CVSS 8.1/9.2); and CVE-2025-7677 is a buffer overflow that can cause denial of service if an attacker reaches the local network (CVSS 5.9/8.2). All three flaws are remotely exploitable with low attack complexity over the network. No active exploitation in the wild has been reported as of publication. ABB's primary mitigation is to upgrade to firmware 3.08.04-s01 and later. ABB strongly recommends that ASPECT systems never be exposed directly to the internet and should only be accessible behind firewalls with VPN gateways for remote access. Organizations should change all default credentials, apply network segmentation, and ensure VPN and network infrastructure are maintained to current security patch levels.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-252-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs