How severe is CVE-2023-0636?

CVE-2023-0636 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-0636 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (68th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-0636?

CVE-2023-0636 primarily affects Abb Aspect-ent-2 Firmware. In total, 19 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-0636?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2023-0636 published?

CVE-2023-0636 was published on 2023-06-05 and last updated on 2026-06-17.

CVE-2023-0636

CVE-2023-0636 is a high-severity vulnerability in Abb Aspect-ent-2 Firmware with a CVSS 3.x base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-77.

Key facts

Severity: High (CVSS 3.x base score 7.2)
EPSS exploit prediction: 1% (68th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-77
Affected product: Abb Aspect-ent-2 Firmware
Published: 2023-06-05
Last modified: 2026-06-17

Description

Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Command Injection.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.0; NEXUS Series: from 3.0;0 before 3.07.0; MATRIX Series: from 3.0;0 before 3.07.1.

Frequently asked questions

What is CVE-2023-0636?: Improper Input Validation vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R2021, 2CQG100104R2021, 2CQG100105R2021, 2CQG100106R2021, 2CQG100110R2021, 2CQG100112R2021, 2CQG100103R2021, 2CQG100107R2021, 2CQG100108R2021, 2CQG100109R2021, 2CQG100111R2021, 2CQG100113R2021 modules), ABB Ltd. MATRIX Series on MATRIX Series, Linux (2CQG100102R1021, 2CQG100103R1021, 2CQG100104R1021, 2CQG100105R1021, 2CQG100106R1021 modules) allows Command Injection.This issue affects ASPECT®-Enterprise: from 3.0;0 before 3.07.0; NEXUS Series: from 3.0;0 before 3.07.0; MATRIX Series: from 3.0;0 before 3.07.1.
How severe is CVE-2023-0636?: CVE-2023-0636 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-0636 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (68th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-0636?: CVE-2023-0636 primarily affects Abb Aspect-ent-2 Firmware. In total, 19 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-0636?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2023-0636 published?: CVE-2023-0636 was published on 2023-06-05 and last updated on 2026-06-17.

References

https://search.abb.com/library/Download.aspx?DocumentID=2CKA000073B5403&LanguageCode=en&DocumentPartId=&Action=Launch

Affected products (19)

cpe:2.3:o:abb:aspect-ent-2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:aspect-ent-12_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:aspect-ent-256_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:aspect-ent-96_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-2128_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-2128-a_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-2128-g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-2128-f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-3-2128_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-3-264_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-264_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-264-a_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-264-g_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:nexus-264-f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:matrix-216_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:matrix-232_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:matrix-296_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:matrix-264_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:abb:matrix-11_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Abb Aspect-ent-2 Firmware

CVE-2024-51551 — Critical (CVSS 10.0): Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default…
CVE-2024-51550 — Critical (CVSS 10.0): Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in…
CVE-2024-51549 — Critical (CVSS 10.0): Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected…
CVE-2024-51545 — Critical (CVSS 10.0): Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list…
CVE-2024-48840 — Critical (CVSS 10.0): Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products: ABB ASPECT - Enterprise…
CVE-2024-48839 — Critical (CVSS 10.0): Improper Input Validation vulnerability allows Remote Code Execution. Affected products: ABB ASPECT - Enterprise…

All CVEs affecting Abb Aspect-ent-2 Firmware →

Other CWE-77 (Command Injection) vulnerabilities

CVE-2026-23652 — Critical (CVSS 10.0): Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an…
CVE-2025-59818 — Critical (CVSS 10.0): This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file…
CVE-2025-64093 — Critical (CVSS 10.0): Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the…
CVE-2025-64090 — Critical (CVSS 10.0): This vulnerability allows authenticated attackers to execute commands via the hostname of the device.
CVE-2025-61492 — Critical (CVSS 10.0): A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to…
CVE-2025-10035 — Critical (CVSS 10.0): A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged…

Browse all CWE-77 (Command Injection) vulnerabilities →