Search criteria
2 vulnerabilities found for B&R VC4 by B&R Industrial Automation
CVE-2023-1617 (GCVE-0-2023-1617)
Vulnerability from cvelistv5 – Published: 2023-04-14 11:48 – Updated: 2025-02-06 19:48
VLAI?
Summary
Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.
This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.
Severity ?
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | B&R VC4 |
Affected:
3.* , ≤ 3.96.7
(custom)
Affected: 4.0* , ≤ 4.06.7 (custom) Affected: 4.1* , ≤ 4.16.3 (custom) Affected: 4.2* , ≤ 4.26.8 (custom) Affected: 4.3* , ≤ 4.34.6 (custom) Affected: 4.4* , ≤ 4.45.1 (custom) Affected: 4.5* , ≤ 4.45.3 (custom) Affected: 4.7* , ≤ 4.72.9 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.043Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1617",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-06T19:48:02.341552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-06T19:48:05.890Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"VNC-Server"
],
"product": "B\u0026R VC4",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThanOrEqual": "3.96.7",
"status": "affected",
"version": "3.*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.06.7",
"status": "affected",
"version": "4.0*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.16.3",
"status": "affected",
"version": "4.1*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.26.8",
"status": "affected",
"version": "4.2*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.6",
"status": "affected",
"version": "4.3*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.45.1",
"status": "affected",
"version": "4.4*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.45.3",
"status": "affected",
"version": "4.5*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.72.9",
"status": "affected",
"version": "4.7*",
"versionType": "custom"
}
]
}
],
"datePublic": "2023-04-13T18:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Authentication vulnerability in B\u0026amp;R Industrial Automation B\u0026amp;R VC4 (VNC-Server modules).\u0026nbsp; This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\u003cbr\u003e\u003cp\u003eThis issue affects B\u0026amp;R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\u003c/p\u003e"
}
],
"value": "Improper Authentication vulnerability in B\u0026R Industrial Automation B\u0026R VC4 (VNC-Server modules).\u00a0 This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\nThis issue affects B\u0026R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-14T11:48:53.396Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper Authentication Mechanism in B\u0026R VC4 Visualization",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2023-1617",
"datePublished": "2023-04-14T11:48:53.396Z",
"dateReserved": "2023-03-24T07:13:36.844Z",
"dateUpdated": "2025-02-06T19:48:05.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1617 (GCVE-0-2023-1617)
Vulnerability from nvd – Published: 2023-04-14 11:48 – Updated: 2025-02-06 19:48
VLAI?
Summary
Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.
This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.
Severity ?
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | B&R VC4 |
Affected:
3.* , ≤ 3.96.7
(custom)
Affected: 4.0* , ≤ 4.06.7 (custom) Affected: 4.1* , ≤ 4.16.3 (custom) Affected: 4.2* , ≤ 4.26.8 (custom) Affected: 4.3* , ≤ 4.34.6 (custom) Affected: 4.4* , ≤ 4.45.1 (custom) Affected: 4.5* , ≤ 4.45.3 (custom) Affected: 4.7* , ≤ 4.72.9 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.043Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1617",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-06T19:48:02.341552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-06T19:48:05.890Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"VNC-Server"
],
"product": "B\u0026R VC4",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThanOrEqual": "3.96.7",
"status": "affected",
"version": "3.*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.06.7",
"status": "affected",
"version": "4.0*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.16.3",
"status": "affected",
"version": "4.1*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.26.8",
"status": "affected",
"version": "4.2*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.6",
"status": "affected",
"version": "4.3*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.45.1",
"status": "affected",
"version": "4.4*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.45.3",
"status": "affected",
"version": "4.5*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.72.9",
"status": "affected",
"version": "4.7*",
"versionType": "custom"
}
]
}
],
"datePublic": "2023-04-13T18:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Authentication vulnerability in B\u0026amp;R Industrial Automation B\u0026amp;R VC4 (VNC-Server modules).\u0026nbsp; This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\u003cbr\u003e\u003cp\u003eThis issue affects B\u0026amp;R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\u003c/p\u003e"
}
],
"value": "Improper Authentication vulnerability in B\u0026R Industrial Automation B\u0026R VC4 (VNC-Server modules).\u00a0 This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\nThis issue affects B\u0026R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-14T11:48:53.396Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper Authentication Mechanism in B\u0026R VC4 Visualization",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2023-1617",
"datePublished": "2023-04-14T11:48:53.396Z",
"dateReserved": "2023-03-24T07:13:36.844Z",
"dateUpdated": "2025-02-06T19:48:05.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}