Vulnerability · Published May 22, 2025 · Assigned by ABB
CVE-2024-13955SQL Injection 2nd Order
High 8.8
In plain English
A high-severity SQL injection in ASPECT-Enterprise from ABB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 66.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
2nd Order SQL injection vulnerabilities in ASPECT allow unintended access and manipulation of database repositories if administrator credentials become compromised.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ABB | ASPECT-Enterprise | 0 – through 3.* |
| ABB | NEXUS Series | 0 – through 3.* |
| ABB | MATRIX Series | 0 – through 3.* |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H