# ABB ASPECT BMS/BAS authentication bypass and buffer overflow

Published: 2025-09-09 · Severity: routine · Sectors: infrastructure
Canonical: https://vorant.io/reports/b6a4c9fa-22f8-563d-aac4-538f62e35765/abb-aspect-bms-bas-authentication-bypass-and-buffer-overflow

> Critical authentication bypass in ABB ASPECT building management systems allows unauthenticated remote control; patch to 3.08.04-s01.

ABB has released a security advisory for multiple vulnerabilities in its ASPECT, NEXUS, and MATRIX building management and automation systems deployed worldwide across commercial facilities. Three vulnerabilities affect all versions of ASPECT prior to 3.08.04-s01: CVE-2025-53187 is an authentication bypass resulting from debugging code left in production firmware, allowing attackers to change system time, access files, and execute function calls without authentication (CVSS 9.8/9.3); CVE-2025-7679 is a missing authentication flaw for critical functions (CVSS 8.1/9.2); and CVE-2025-7677 is a buffer overflow that can cause denial of service if an attacker reaches the local network (CVSS 5.9/8.2). All three flaws are remotely exploitable with low attack complexity over the network. No active exploitation in the wild has been reported as of publication. ABB's primary mitigation is to upgrade to firmware 3.08.04-s01 and later. ABB strongly recommends that ASPECT systems never be exposed directly to the internet and should only be accessible behind firewalls with VPN gateways for remote access. Organizations should change all default credentials, apply network segmentation, and ensure VPN and network infrastructure are maintained to current security patch levels.

## Mentioned in this report

- Vulnerabilities: CVE-2025-53187, CVE-2025-7677, CVE-2025-7679

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-252-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b6a4c9fa-22f8-563d-aac4-538f62e35765/abb-aspect-bms-bas-authentication-bypass-and-buffer-overflow.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup