ABB Cylon Aspect 3.08.01 (jsonProxy.php) Unauthenticated Credentials Disclosure

The ABB BMS/BAS controller allows an unauthenticated attacker to disclose credentials in plain-text.