CVE-2024-6209 is a critical unauthorized file access flaw in the web server of ABB ASPECT, NEXUS and MATRIX building energy controllers, scored 10.0. ABB's advisory lists firmware 3.08.03 and newer as the fix. Upgrade, keep the devices off the public internet, and change any default passwords.
What's affected
The record describes unauthorized file access in the web server of ABB ASPECT Enterprise, NEXUS Series and MATRIX Series version 3.08.01. The weakness is CWE-552, files or directories accessible to external parties. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with no privileges or user interaction needed.
ABB's cyber security advisory, document 9AKK108469A7497, covers the whole ASPECT family and lists several CVEs together. Its affected firmware reads 3.08.02 and earlier, with 3.08.03 and newer as the fixed line, for the ASP-ENT, NEX and NEXUS, and MAT model groups.
The two sources differ on versions. The record names 3.08.01, while the advisory table says 3.08.02 and earlier. Use the advisory, since it is wider and comes from the vendor. The score is 10.0 in both places. The advisory adds a temporal score of 9.7 and a CVSS v4.0 score of 10.
The record does not flag the CVE as exploited, and it is not in the KEV catalog.
How to check if you're exposed
Check the firmware version on each controller from the device web interface, then compare it with 3.08.03. Anything at 3.08.02 or below is in scope. Match the model against the advisory's product ID list if you are unsure whether a unit belongs to the ASPECT family.
Then check how the device is reachable. ABB says the vulnerabilities are only exploitable if an attacker can reach the network segment where ASPECT is installed, and it stresses that devices must never be exposed directly to the internet, either through an ISP connection or NAT port forwarding. A quick review of your perimeter rules and port forwards tells you whether that condition holds.
What to do now
- Inventory every ASPECT, NEXUS and MATRIX unit and read its firmware version.
- Upgrade to firmware 3.08.03 or newer. The advisory points to the product homepage for the latest firmware.
- Remove any direct internet exposure or port forwarding to the devices.
- If remote access is a real need, put the device behind a firewall and reach it over a VPN gateway that is itself patched and maintained.
- Change default passwords if they are still in use, as ABB recommends for system integrators.
Why it matters
Building energy controllers sit between IT and operational technology. They collect energy data and can trigger controls that tune consumption in a building. A web server that hands out files to anyone who asks can expose configuration and credentials, which then supports further attacks on the same device.
The class of weakness is a missing access check on files the server holds. The scoring shows how serious that is here, with high confidentiality, integrity and availability impact and a changed scope. A bundled advisory also means other CVEs in the same document may apply to the same units, so read the full table and not just this one entry.
Quick check
Which firmware fixes it?
ABB lists 3.08.03 and newer as the fixed line. The record only names 3.08.01 as affected, so rely on the advisory table.
Is a firewall enough?
It reduces the risk a lot, and ABB recommends it, but the vendor fix is the firmware update. Do both.
Sources
- ABB cyber security advisory 9AKK108469A7497
- NVD record for CVE-2024-6209, as held in the batch record file
Last reviewed: 19 October 2026.
