CVE-2024-51547 is a critical severity (CVSS 9.8) hard-coded credentials flaw in ABB ASPECT-Enterprise, NEXUS Series and MATRIX Series through version 3.x. The record lists no fixed version, so read the ABB public advisory and restrict network access to these building management controllers.
What's affected
The record says the issue affects ASPECT-Enterprise through 3., NEXUS Series through 3. and MATRIX Series through 3.*. The NVD product list includes the aspect-ent models and their firmware.
The ABB advisory is a PDF, and its text could not be read reliably during review, so this post does not state a fixed version or mitigation. Open the advisory directly for the patch details and ABB recommendations.
These are energy management and building automation products, which are often deployed on operational networks, sometimes with remote access for contractors.
How to check if you're exposed
Read the firmware version of each controller from its web interface or from your asset records. If the series is ASPECT-Enterprise, NEXUS or MATRIX and the version is in the 3.x line or earlier, treat it as affected.
Then check what can reach it. Controllers like these should not be reachable from the internet or from general office networks. Search your network scan results for their web and management ports, and check firewall rules for any open remote access.
What to do now
- Make a list of ABB ASPECT-Enterprise, NEXUS and MATRIX devices with their versions.
- Read the ABB advisory and apply the firmware update or the mitigation it describes.
- Block internet access to the devices and limit them to a management network.
- Place remote access behind a VPN with multi factor authentication.
- Review access logs on the devices for unfamiliar logins.
Why it matters
The weakness is CWE-798 (Use of Hard-coded Credentials). A credential that is built into the product is the same on every unit, so anyone who learns it can log in to all of them, and the owner often cannot change it. This is a design problem rather than a coding slip, and a fix generally has to come from the vendor.
The 9.8 score shows network reach with no privileges. Building controllers influence physical systems, which is why exposure matters beyond data. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-51547.
Quick check
Which versions are affected?
The record says ASPECT-Enterprise, NEXUS Series and MATRIX Series through 3.*.
Can I fix this by changing the password?
The weakness is that credentials are hard-coded in the product, so rely on the vendor update and network controls rather than a password change alone.
Sources
- ABB public advisory (listed in the NVD record, text not reliably readable during review)
- Gold entry for CVE-2024-51547
Last reviewed: 19 October 2026.
