Search criteria
21 vulnerabilities found for automation_runtime by br-automation
FKIE_CVE-2023-6028
Vulnerability from fkie_nvd - Published: 2024-02-05 18:15 - Updated: 2024-11-21 08:43
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A reflected
cross-site scripting (XSS) vulnerability exists in the SVG version of System
Diagnostics Manager of B&R Automation Runtime versions <= G4.93 that
enables a remote attacker to execute arbitrary JavaScript code in the context
of the attacked user’s browser session.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| br-automation | automation_runtime | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "884D020E-3583-4A39-A843-DB5977674E39",
"versionEndExcluding": "i4.93",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A reflected\ncross-site scripting (XSS) vulnerability exists in the SVG version of System\nDiagnostics Manager of B\u0026R Automation Runtime versions \u003c= G4.93 that\nenables a remote attacker to execute arbitrary JavaScript code in the context\nof the attacked user\u2019s browser session.\n\n\n\n\n\n\n\n"
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de cross-site scripting (XSS) reflejada en la versi\u00f3n SVG de System Diagnostics Manager de B\u0026amp;R Automation Runtime versiones \u0026lt;= G4.93 que permite a un atacante remoto ejecutar c\u00f3digo JavaScript arbitrario en el contexto de la sesi\u00f3n del navegador del usuario atacado."
}
],
"id": "CVE-2023-6028",
"lastModified": "2024-11-21T08:43:00.503",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-05T18:15:51.670",
"references": [
{
"source": "cybersecurity@ch.abb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/fileadmin/SA23P018_SDM_Web_interface_vulnerable_to_XSS-1d75bee8.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/fileadmin/SA23P018_SDM_Web_interface_vulnerable_to_XSS-1d75bee8.pdf"
}
],
"sourceIdentifier": "cybersecurity@ch.abb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2024-0323
Vulnerability from fkie_nvd - Published: 2024-02-05 16:15 - Updated: 2024-11-21 08:46
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The FTP server used on the B&R
Automation Runtime supports unsecure encryption mechanisms, such as SSLv3,
TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct
man-in-the-middle attacks or to decrypt communications between the affected product
clients.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| br-automation | automation_runtime | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B9413C6B-C322-4F68-8CA3-EA167591CED0",
"versionEndIncluding": "i4.93",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The FTP server used on the B\u0026R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients."
},
{
"lang": "es",
"value": "Uso de una vulnerabilidad de algoritmo criptogr\u00e1fico defectuoso o riesgoso en B\u0026amp;R Industrial Automation Automation Runtime (m\u00f3dulos SDM). El servidor FTP utilizado en B\u0026amp;R Automation Runtime admite mecanismos de cifrado no seguros, como SSLv3, TLSv1.0 y TLS1.1. Un atacante basado en red puede explotar las fallas para realizar ataques de intermediario o para descifrar las comunicaciones entre los clientes del producto afectado. Este problema afecta a Automation Runtime: desde 14.0 antes de 14.93."
}
],
"id": "CVE-2024-0323",
"lastModified": "2024-11-21T08:46:19.440",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-02-05T16:15:54.980",
"references": [
{
"source": "cybersecurity@ch.abb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encryption_mechanisms-f57c147c.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encryption_mechanisms-f57c147c.pdf"
}
],
"sourceIdentifier": "cybersecurity@ch.abb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1240"
}
],
"source": "cybersecurity@ch.abb.com",
"type": "Primary"
}
]
}
FKIE_CVE-2023-3242
Vulnerability from fkie_nvd - Published: 2023-07-26 18:15 - Updated: 2024-11-21 08:16
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| br-automation | automation_runtime | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4367AD90-1F40-4242-AB9F-BB7BB65E2465",
"versionEndExcluding": "g4.93",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper initialization implementation in Portmapper used in B\u0026R Industrial Automation Automation Runtime \u003cG4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions."
}
],
"id": "CVE-2023-3242",
"lastModified": "2024-11-21T08:16:46.917",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-07-26T18:15:11.147",
"references": [
{
"source": "cybersecurity@ch.abb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1689787619746-en-original-1.0.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1689787619746-en-original-1.0.pdf"
}
],
"sourceIdentifier": "cybersecurity@ch.abb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-665"
},
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "cybersecurity@ch.abb.com",
"type": "Primary"
}
]
}
FKIE_CVE-2022-4286
Vulnerability from fkie_nvd - Published: 2023-02-14 15:15 - Updated: 2024-11-21 07:34
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| br-automation | automation_runtime | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52FF5129-8311-4830-93B4-3CB031200854",
"versionEndIncluding": "c4.93",
"versionStartIncluding": "3.00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nA reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B\u0026R Automation Runtime versions \u003e=3.00 and \u003c=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.\n\n"
}
],
"id": "CVE-2022-4286",
"lastModified": "2024-11-21T07:34:56.647",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-02-14T15:15:11.247",
"references": [
{
"source": "cybersecurity@ch.abb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1675607299099-en-original-1.0.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1675607299099-en-original-1.0.pdf"
}
],
"sourceIdentifier": "cybersecurity@ch.abb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-22275
Vulnerability from fkie_nvd - Published: 2022-05-13 15:15 - Updated: 2024-11-21 05:49
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Summary
Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| br-automation | automation_runtime | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D2BDE298-669C-4AFA-AAE1-E8568D3CEBD1",
"versionEndExcluding": "4.91",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Buffer Overflow vulnerability in B\u0026R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service."
},
{
"lang": "es",
"value": "Una vulnerabilidad de desbordamiento del b\u00fafer en el servidor web de B\u0026amp;R Automation Runtime permite a un atacante no autenticado basado en la red detener el programa c\u00edclico en el dispositivo y causar una denegaci\u00f3n de servicio"
}
],
"id": "CVE-2021-22275",
"lastModified": "2024-11-21T05:49:49.593",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-05-13T15:15:08.130",
"references": [
{
"source": "cybersecurity@ch.abb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf"
}
],
"sourceIdentifier": "cybersecurity@ch.abb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-120"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2020-11637
Vulnerability from fkie_nvd - Published: 2020-10-15 16:15 - Updated: 2024-11-21 04:58
Severity ?
5.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A memory leak in the TFTP service in B&R Automation Runtime versions <N4.26, <N4.34, <F4.45, <E4.53, <D4.63, <A4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B5691819-5BAF-4021-BB67-3D4801A050EC",
"versionEndIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "142DABF7-D81E-4192-B5C8-2BB31CC75956",
"versionEndExcluding": "n4.26",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7EF78DE7-687D-40A7-9D3B-ACBB2CFAF44B",
"versionEndExcluding": "f4.45",
"versionStartIncluding": "4.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AC4663FB-8910-4A9F-955B-6E003949638B",
"versionEndExcluding": "e4.53",
"versionStartIncluding": "4.50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1A7C52DE-F161-426F-B890-BF37938F9CF6",
"versionEndExcluding": "d4.63",
"versionStartIncluding": "4.60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "52A6E5FF-E093-4492-8DB3-3F888ED10ADB",
"versionEndExcluding": "a4.73",
"versionStartIncluding": "4.70",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3C4DFCB9-820B-4283-8700-92B9C0AC0AA1",
"versionEndExcluding": "n4.34",
"versionStartIncluding": "4.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A memory leak in the TFTP service in B\u0026R Automation Runtime versions \u003cN4.26, \u003cN4.34, \u003cF4.45, \u003cE4.53, \u003cD4.63, \u003cA4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition."
},
{
"lang": "es",
"value": "Una p\u00e9rdida de memoria en el servicio TFTP en B\u0026amp;R Automation Runtime en versiones anteriores a N4.26, anteriores a N4.34, anteriores a F4.45, anteriores a E4.53, anteriores a D4.63, anteriores a A4.73 y anteriores, podr\u00eda permitir a un atacante no autenticado con acceso de red causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS)"
}
],
"id": "CVE-2020-11637",
"lastModified": "2024-11-21T04:58:18.000",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-10-15T16:15:11.773",
"references": [
{
"source": "cybersecurity@ch.abb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf"
}
],
"sourceIdentifier": "cybersecurity@ch.abb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-401"
}
],
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-401"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2019-19108
Vulnerability from fkie_nvd - Published: 2020-04-20 22:15 - Updated: 2024-11-21 04:34
Severity ?
9.4 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
9.4 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
9.4 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Summary
An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP.
References
| URL | Tags | ||
|---|---|---|---|
| cybersecurity@ch.abb.com | https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/ | Vendor Advisory | |
| cybersecurity@ch.abb.com | https://www.us-cert.gov/ics/advisories/icsa-20-051-01 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.us-cert.gov/ics/advisories/icsa-20-051-01 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| br-automation | automation_runtime | * | |
| br-automation | automation_runtime | * | |
| br-automation | automation_runtime | * | |
| br-automation | automation_runtime | 2.96 | |
| br-automation | automation_runtime | 3.00 | |
| br-automation | automation_runtime | 3.01 | |
| br-automation | automation_runtime | 3.06 | |
| br-automation | automation_runtime | 3.07 | |
| br-automation | automation_runtime | 4.72 | |
| br-automation | automation_studio | * | |
| br-automation | automation_studio | 2.7 | |
| br-automation | automation_studio | 3.0.71 | |
| br-automation | automation_studio | 3.0.80 | |
| br-automation | automation_studio | 3.0.81 | |
| br-automation | automation_studio | 3.0.90 | |
| br-automation | automation_studio | 4.7.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "92007641-9F08-49BC-8FBE-299E1B8F5D6E",
"versionEndIncluding": "3.10",
"versionStartIncluding": "3.08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4F6F991A-DEAC-48E6-B920-3E5C2DF71126",
"versionEndIncluding": "4.03",
"versionStartIncluding": "4.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DBFD0529-3DBC-4F33-A8DB-3E0425249A0F",
"versionEndIncluding": "4.63",
"versionStartIncluding": "4.04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:2.96:*:*:*:*:*:*:*",
"matchCriteriaId": "4336DDC3-2E0B-4003-9DD2-0F6B792224E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:3.00:*:*:*:*:*:*:*",
"matchCriteriaId": "627F13C8-8C9C-4821-8669-048D4129AA0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:3.01:*:*:*:*:*:*:*",
"matchCriteriaId": "938E07B7-4EA6-4C9F-AFE3-34D6871FD8E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:3.06:*:*:*:*:*:*:*",
"matchCriteriaId": "86226E55-0103-491D-9CE2-F70DF0F02FCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:3.07:*:*:*:*:*:*:*",
"matchCriteriaId": "1EA14826-AB36-438F-85EF-012AF77C84B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_runtime:4.72:*:*:*:*:*:*:*",
"matchCriteriaId": "ABB62E4A-4595-45FD-B9A3-6B72CA96B5A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*",
"matchCriteriaId": "150E3C63-DA0E-4E4E-A778-ADC1BEB3FA14",
"versionEndIncluding": "4.6.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_studio:2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "345C741C-4575-4234-92E7-1059703505BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_studio:3.0.71:*:*:*:*:*:*:*",
"matchCriteriaId": "5C516EA0-BB55-4554-AB27-B56423A5DE8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_studio:3.0.80:*:*:*:*:*:*:*",
"matchCriteriaId": "0459007D-DFC7-4EEA-8336-E05637672FDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_studio:3.0.81:*:*:*:*:*:*:*",
"matchCriteriaId": "B77D56F4-AFB5-4346-B6A9-1DF87D67D577",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_studio:3.0.90:*:*:*:*:*:*:*",
"matchCriteriaId": "A6B1A4A3-2201-49D0-BAB9-CFE94DB77C90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:automation_studio:4.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4007CF20-9AEE-47F9-A48A-0837739D95F1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An authentication weakness in the SNMP service in B\u0026R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B\u0026R products via SNMP."
},
{
"lang": "es",
"value": "Una debilidad de autenticaci\u00f3n en el servicio SNMP en B\u0026amp;R Automation Runtime versiones 2.96, 3.00, 3.01, versiones 3.06 hasta 3.10, versiones 4.00 hasta 4.63, 4.72 y superiores, permite a usuarios no autenticados modificar la configuraci\u00f3n de los productos B\u0026amp;R por medio de SNMP."
}
],
"id": "CVE-2019-19108",
"lastModified": "2024-11-21T04:34:12.763",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.5,
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-04-20T22:15:13.510",
"references": [
{
"source": "cybersecurity@ch.abb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/"
},
{
"source": "cybersecurity@ch.abb.com",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01"
}
],
"sourceIdentifier": "cybersecurity@ch.abb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-798"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2023-6028 (GCVE-0-2023-6028)
Vulnerability from cvelistv5 – Published: 2024-02-05 17:33 – Updated: 2024-08-02 08:21
VLAI?
Summary
A reflected
cross-site scripting (XSS) vulnerability exists in the SVG version of System
Diagnostics Manager of B&R Automation Runtime versions <= G4.93 that
enables a remote attacker to execute arbitrary JavaScript code in the context
of the attacked user’s browser session.
Severity ?
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | Automation Runtime |
Affected:
14.0 , < 14.93
(patch)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6028",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-07T18:48:50.631233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:03.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:21:17.060Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/fileadmin/SA23P018_SDM_Web_interface_vulnerable_to_XSS-1d75bee8.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"SDM"
],
"product": "Automation Runtime",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "14.93",
"status": "affected",
"version": "14.0",
"versionType": "patch"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA reflected\ncross-site scripting (XSS) vulnerability exists in the SVG version of System\nDiagnostics Manager of B\u0026amp;R Automation Runtime versions \u0026lt;= G4.93 that\nenables a remote attacker to execute arbitrary JavaScript code in the context\nof the attacked user\u2019s browser session.\u003c/p\u003e\n\n\n\n\n\n"
}
],
"value": "A reflected\ncross-site scripting (XSS) vulnerability exists in the SVG version of System\nDiagnostics Manager of B\u0026R Automation Runtime versions \u003c= G4.93 that\nenables a remote attacker to execute arbitrary JavaScript code in the context\nof the attacked user\u2019s browser session.\n\n\n\n\n\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-06T13:54:25.416Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/fileadmin/SA23P018_SDM_Web_interface_vulnerable_to_XSS-1d75bee8.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An update is available that resolves a vulnerability in the product versions listed above."
}
],
"value": "An update is available that resolves a vulnerability in the product versions listed above."
}
],
"source": {
"advisory": "SA23P018",
"discovery": "INTERNAL"
},
"title": "SDM Web interface vulnerable to XSS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eDo not use Hyperlinks provided by untrusted 3rd party to access the SDM. Hyperlinks may be provided via:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eEmails from unknown users\u003c/li\u003e\u003cli\u003eSocial media channels\u003c/li\u003e\u003cli\u003eMessaging services\u003c/li\u003e\u003cli\u003eWebpages with comment functionality\u003c/li\u003e\u003cli\u003eQR Codes\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe use of external Web Application Firewalls (WAF) can mitigate attacks using reflected cross-site scripting.\u003c/p\u003e"
}
],
"value": "\nDo not use Hyperlinks provided by untrusted 3rd party to access the SDM. Hyperlinks may be provided via:\n\n\n\n * Emails from unknown users\n * Social media channels\n * Messaging services\n * Webpages with comment functionality\n * QR Codes\n\n\n\n\nThe use of external Web Application Firewalls (WAF) can mitigate attacks using reflected cross-site scripting.\n\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2023-6028",
"datePublished": "2024-02-05T17:33:34.785Z",
"dateReserved": "2023-11-08T10:17:50.175Z",
"dateUpdated": "2024-08-02T08:21:17.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0323 (GCVE-0-2024-0323)
Vulnerability from cvelistv5 – Published: 2024-02-05 16:05 – Updated: 2024-09-06 07:21
VLAI?
Summary
The FTP server used on the B&R
Automation Runtime supports unsecure encryption mechanisms, such as SSLv3,
TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct
man-in-the-middle attacks or to decrypt communications between the affected product
clients.
Severity ?
9.8 (Critical)
CWE
- CWE-1240 - Use of a Cryptographic Primitive with a Risky Implementation
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | Automation Runtime |
Affected:
14.0 , < 14.93
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:04:49.140Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encryption_mechanisms-f57c147c.pdf"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "automation_runtime",
"vendor": "br-automation",
"versions": [
{
"lessThan": "14.93",
"status": "affected",
"version": "14.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-22T14:10:59.497846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T14:16:16.093Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"SDM"
],
"product": "Automation Runtime",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "14.93",
"status": "affected",
"version": "14.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The FTP server used on the B\u0026amp;R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients. \u0026nbsp;\n\n\u003cbr\u003e"
}
],
"value": "The FTP server used on the B\u0026R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1240",
"description": "CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T07:21:29.270Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encryption_mechanisms-f57c147c.pdf"
}
],
"source": {
"advisory": "SA23P018",
"discovery": "INTERNAL"
},
"title": "FTP uses unsecure encryption mechanisms",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2024-0323",
"datePublished": "2024-02-05T16:05:47.612Z",
"dateReserved": "2024-01-08T13:02:23.041Z",
"dateUpdated": "2024-09-06T07:21:29.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3242 (GCVE-0-2023-3242)
Vulnerability from cvelistv5 – Published: 2023-07-26 17:36 – Updated: 2024-10-23 15:31
VLAI?
Summary
Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions.
Severity ?
8.6 (High)
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | B&R Automation Runtime |
Affected:
<G4.93
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:48:08.336Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1689787619746-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-23T15:31:14.569229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-23T15:31:51.096Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "B\u0026R Automation Runtime",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"status": "affected",
"version": "\u003cG4.93"
}
]
}
],
"datePublic": "2023-07-25T22:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nImproper initialization implementation in Portmapper used in B\u0026amp;R Industrial Automation Automation Runtime \u0026lt;G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions.\n\n"
}
],
"value": "Improper initialization implementation in Portmapper used in B\u0026R Industrial Automation Automation Runtime \u003cG4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-27T07:12:22.331Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1689787619746-en-original-1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2023-3242",
"datePublished": "2023-07-26T17:36:18.417Z",
"dateReserved": "2023-06-14T11:28:13.641Z",
"dateUpdated": "2024-10-23T15:31:51.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-4286 (GCVE-0-2022-4286)
Vulnerability from cvelistv5 – Published: 2023-02-14 14:25 – Updated: 2025-03-20 14:07
VLAI?
Summary
A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.
Severity ?
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | B&R Automation Runtime |
Affected:
>=3.00 , ≤ C4.93
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:34:50.116Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1675607299099-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-4286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-20T14:07:48.804634Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T14:07:56.101Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"System Diagnostics Manager"
],
"product": "B\u0026R Automation Runtime",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThanOrEqual": "C4.93",
"status": "affected",
"version": "\u003e=3.00",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B\u0026amp;R Automation Runtime versions \u0026gt;=3.00 and \u0026lt;=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.\u003c/span\u003e\n\n"
}
],
"value": "\nA reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B\u0026R Automation Runtime versions \u003e=3.00 and \u003c=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-15T02:14:49.612Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1675607299099-en-original-1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected Cross-Site Scripting Vulnerabilities in Automation Runtime",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2022-4286",
"datePublished": "2023-02-14T14:25:37.538Z",
"dateReserved": "2022-12-05T12:14:29.593Z",
"dateUpdated": "2025-03-20T14:07:56.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22275 (GCVE-0-2021-22275)
Vulnerability from cvelistv5 – Published: 2022-05-13 14:23 – Updated: 2024-08-03 18:37
VLAI?
Summary
Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service.
Severity ?
8.6 (High)
CWE
- CWE-120 - Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Automation | Automation Runtime webserver |
Affected:
unspecified , < 4.91
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:37:18.446Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Automation Runtime webserver",
"vendor": "B\u0026R Automation",
"versions": [
{
"lessThan": "4.91",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer Overflow vulnerability in B\u0026R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-13T14:23:20",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial of service vulnerability on Automation Runtime webserver",
"workarounds": [
{
"lang": "en",
"value": "B\u0026R recommends the following specific workarounds and mitigations:\nThe access to the Automation Runtime webserver should be restricted to legitimate network partners, using e.g. a sufficient Firewall setup and robust network segmentation. \nB\u0026R recommends deactivating Automation Runtime webserver when not needed."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@ch.abb.com",
"ID": "CVE-2021-22275",
"STATE": "PUBLIC",
"TITLE": "Denial of service vulnerability on Automation Runtime webserver"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Automation Runtime webserver",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.91"
}
]
}
}
]
},
"vendor_name": "B\u0026R Automation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Buffer Overflow vulnerability in B\u0026R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-120 Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf",
"refsource": "MISC",
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf"
}
]
},
"source": {
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "B\u0026R recommends the following specific workarounds and mitigations:\nThe access to the Automation Runtime webserver should be restricted to legitimate network partners, using e.g. a sufficient Firewall setup and robust network segmentation. \nB\u0026R recommends deactivating Automation Runtime webserver when not needed."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2021-22275",
"datePublished": "2022-05-13T14:23:20",
"dateReserved": "2021-01-05T00:00:00",
"dateUpdated": "2024-08-03T18:37:18.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-11637 (GCVE-0-2020-11637)
Vulnerability from cvelistv5 – Published: 2020-10-15 15:08 – Updated: 2024-09-16 16:33
VLAI?
Summary
A memory leak in the TFTP service in B&R Automation Runtime versions <N4.26, <N4.34, <F4.45, <E4.53, <D4.63, <A4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition.
Severity ?
5.8 (Medium)
CWE
- CWE-401 - Improper Release of Memory Before Removing Last Reference
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R | Automation Runtime |
Affected:
unspecified , ≤ 4.1x
(custom)
Affected: 4.2x , < N4.26 (custom) Affected: 4.3x , < N4.34 (custom) Affected: 4.4x , < F4.45 (custom) Affected: 4.5x , < E4.53 (custom) Affected: 4.6x , < D4.63 (custom) Affected: 4.7x , < A4.73 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:35:13.385Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Automation Runtime",
"vendor": "B\u0026R",
"versions": [
{
"lessThanOrEqual": "4.1x",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "N4.26",
"status": "affected",
"version": "4.2x",
"versionType": "custom"
},
{
"lessThan": "N4.34",
"status": "affected",
"version": "4.3x",
"versionType": "custom"
},
{
"lessThan": "F4.45",
"status": "affected",
"version": "4.4x",
"versionType": "custom"
},
{
"lessThan": "E4.53",
"status": "affected",
"version": "4.5x",
"versionType": "custom"
},
{
"lessThan": "D4.63",
"status": "affected",
"version": "4.6x",
"versionType": "custom"
},
{
"lessThan": "A4.73",
"status": "affected",
"version": "4.7x",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-08-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A memory leak in the TFTP service in B\u0026R Automation Runtime versions \u003cN4.26, \u003cN4.34, \u003cF4.45, \u003cE4.53, \u003cD4.63, \u003cA4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401 Improper Release of Memory Before Removing Last Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-10-15T15:08:14",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Automation Runtime TFTP Service DoS Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@ch.abb.com",
"DATE_PUBLIC": "2020-08-12T00:00:00.000Z",
"ID": "CVE-2020-11637",
"STATE": "PUBLIC",
"TITLE": "Automation Runtime TFTP Service DoS Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Automation Runtime",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "4.1x"
},
{
"version_affected": "\u003c",
"version_name": "4.2x",
"version_value": "N4.26"
},
{
"version_affected": "\u003c",
"version_name": "4.3x",
"version_value": "N4.34"
},
{
"version_affected": "\u003c",
"version_name": "4.4x",
"version_value": "F4.45"
},
{
"version_affected": "\u003c",
"version_name": "4.5x",
"version_value": "E4.53"
},
{
"version_affected": "\u003c",
"version_name": "4.6x",
"version_value": "D4.63"
},
{
"version_affected": "\u003c",
"version_name": "4.7x",
"version_value": "A4.73"
}
]
}
}
]
},
"vendor_name": "B\u0026R"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A memory leak in the TFTP service in B\u0026R Automation Runtime versions \u003cN4.26, \u003cN4.34, \u003cF4.45, \u003cE4.53, \u003cD4.63, \u003cA4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-401 Improper Release of Memory Before Removing Last Reference"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf",
"refsource": "MISC",
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2020-11637",
"datePublished": "2020-10-15T15:08:14.438915Z",
"dateReserved": "2020-04-08T00:00:00",
"dateUpdated": "2024-09-16T16:33:01.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-19108 (GCVE-0-2019-19108)
Vulnerability from cvelistv5 – Published: 2020-04-20 21:48 – Updated: 2024-08-05 02:09
VLAI?
Summary
An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP.
Severity ?
9.4 (Critical)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R | Automation Runtime |
Affected:
2 <= 2.96
Affected: 3 <= 3.10 Affected: 4 <= 4.72 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T02:09:39.340Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Automation Runtime",
"vendor": "B\u0026R",
"versions": [
{
"status": "affected",
"version": "2 \u003c= 2.96"
},
{
"status": "affected",
"version": "3 \u003c= 3.10"
},
{
"status": "affected",
"version": "4 \u003c= 4.72"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication weakness in the SNMP service in B\u0026R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B\u0026R products via SNMP."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-27T20:21:55",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "B\u0026R Automation Runtime SNMP Authentication and Authorization Weakness",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@ch.abb.com",
"ID": "CVE-2019-19108",
"STATE": "PUBLIC",
"TITLE": "B\u0026R Automation Runtime SNMP Authentication and Authorization Weakness"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Automation Runtime",
"version": {
"version_data": [
{
"version_value": "2 \u003c= 2.96"
},
{
"version_value": "3 \u003c= 3.10"
},
{
"version_value": "4 \u003c= 4.72"
}
]
}
}
]
},
"vendor_name": "B\u0026R"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authentication weakness in the SNMP service in B\u0026R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B\u0026R products via SNMP."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-798 Use of Hard-coded Credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/",
"refsource": "CONFIRM",
"url": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/"
},
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2019-19108",
"datePublished": "2020-04-20T21:48:29",
"dateReserved": "2019-11-18T00:00:00",
"dateUpdated": "2024-08-05T02:09:39.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6028 (GCVE-0-2023-6028)
Vulnerability from nvd – Published: 2024-02-05 17:33 – Updated: 2024-08-02 08:21
VLAI?
Summary
A reflected
cross-site scripting (XSS) vulnerability exists in the SVG version of System
Diagnostics Manager of B&R Automation Runtime versions <= G4.93 that
enables a remote attacker to execute arbitrary JavaScript code in the context
of the attacked user’s browser session.
Severity ?
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | Automation Runtime |
Affected:
14.0 , < 14.93
(patch)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6028",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-07T18:48:50.631233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:03.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:21:17.060Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/fileadmin/SA23P018_SDM_Web_interface_vulnerable_to_XSS-1d75bee8.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"SDM"
],
"product": "Automation Runtime",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "14.93",
"status": "affected",
"version": "14.0",
"versionType": "patch"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA reflected\ncross-site scripting (XSS) vulnerability exists in the SVG version of System\nDiagnostics Manager of B\u0026amp;R Automation Runtime versions \u0026lt;= G4.93 that\nenables a remote attacker to execute arbitrary JavaScript code in the context\nof the attacked user\u2019s browser session.\u003c/p\u003e\n\n\n\n\n\n"
}
],
"value": "A reflected\ncross-site scripting (XSS) vulnerability exists in the SVG version of System\nDiagnostics Manager of B\u0026R Automation Runtime versions \u003c= G4.93 that\nenables a remote attacker to execute arbitrary JavaScript code in the context\nof the attacked user\u2019s browser session.\n\n\n\n\n\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-06T13:54:25.416Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/fileadmin/SA23P018_SDM_Web_interface_vulnerable_to_XSS-1d75bee8.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An update is available that resolves a vulnerability in the product versions listed above."
}
],
"value": "An update is available that resolves a vulnerability in the product versions listed above."
}
],
"source": {
"advisory": "SA23P018",
"discovery": "INTERNAL"
},
"title": "SDM Web interface vulnerable to XSS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eDo not use Hyperlinks provided by untrusted 3rd party to access the SDM. Hyperlinks may be provided via:\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eEmails from unknown users\u003c/li\u003e\u003cli\u003eSocial media channels\u003c/li\u003e\u003cli\u003eMessaging services\u003c/li\u003e\u003cli\u003eWebpages with comment functionality\u003c/li\u003e\u003cli\u003eQR Codes\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe use of external Web Application Firewalls (WAF) can mitigate attacks using reflected cross-site scripting.\u003c/p\u003e"
}
],
"value": "\nDo not use Hyperlinks provided by untrusted 3rd party to access the SDM. Hyperlinks may be provided via:\n\n\n\n * Emails from unknown users\n * Social media channels\n * Messaging services\n * Webpages with comment functionality\n * QR Codes\n\n\n\n\nThe use of external Web Application Firewalls (WAF) can mitigate attacks using reflected cross-site scripting.\n\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2023-6028",
"datePublished": "2024-02-05T17:33:34.785Z",
"dateReserved": "2023-11-08T10:17:50.175Z",
"dateUpdated": "2024-08-02T08:21:17.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-0323 (GCVE-0-2024-0323)
Vulnerability from nvd – Published: 2024-02-05 16:05 – Updated: 2024-09-06 07:21
VLAI?
Summary
The FTP server used on the B&R
Automation Runtime supports unsecure encryption mechanisms, such as SSLv3,
TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct
man-in-the-middle attacks or to decrypt communications between the affected product
clients.
Severity ?
9.8 (Critical)
CWE
- CWE-1240 - Use of a Cryptographic Primitive with a Risky Implementation
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | Automation Runtime |
Affected:
14.0 , < 14.93
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:04:49.140Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encryption_mechanisms-f57c147c.pdf"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "automation_runtime",
"vendor": "br-automation",
"versions": [
{
"lessThan": "14.93",
"status": "affected",
"version": "14.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-0323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-22T14:10:59.497846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T14:16:16.093Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"SDM"
],
"product": "Automation Runtime",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "14.93",
"status": "affected",
"version": "14.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The FTP server used on the B\u0026amp;R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients. \u0026nbsp;\n\n\u003cbr\u003e"
}
],
"value": "The FTP server used on the B\u0026R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1240",
"description": "CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T07:21:29.270Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encryption_mechanisms-f57c147c.pdf"
}
],
"source": {
"advisory": "SA23P018",
"discovery": "INTERNAL"
},
"title": "FTP uses unsecure encryption mechanisms",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2024-0323",
"datePublished": "2024-02-05T16:05:47.612Z",
"dateReserved": "2024-01-08T13:02:23.041Z",
"dateUpdated": "2024-09-06T07:21:29.270Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3242 (GCVE-0-2023-3242)
Vulnerability from nvd – Published: 2023-07-26 17:36 – Updated: 2024-10-23 15:31
VLAI?
Summary
Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions.
Severity ?
8.6 (High)
CWE
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | B&R Automation Runtime |
Affected:
<G4.93
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:48:08.336Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1689787619746-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-23T15:31:14.569229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-23T15:31:51.096Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "B\u0026R Automation Runtime",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"status": "affected",
"version": "\u003cG4.93"
}
]
}
],
"datePublic": "2023-07-25T22:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nImproper initialization implementation in Portmapper used in B\u0026amp;R Industrial Automation Automation Runtime \u0026lt;G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions.\n\n"
}
],
"value": "Improper initialization implementation in Portmapper used in B\u0026R Industrial Automation Automation Runtime \u003cG4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-27T07:12:22.331Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1689787619746-en-original-1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2023-3242",
"datePublished": "2023-07-26T17:36:18.417Z",
"dateReserved": "2023-06-14T11:28:13.641Z",
"dateUpdated": "2024-10-23T15:31:51.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-4286 (GCVE-0-2022-4286)
Vulnerability from nvd – Published: 2023-02-14 14:25 – Updated: 2025-03-20 14:07
VLAI?
Summary
A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.
Severity ?
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | B&R Automation Runtime |
Affected:
>=3.00 , ≤ C4.93
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:34:50.116Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1675607299099-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-4286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-20T14:07:48.804634Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T14:07:56.101Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"System Diagnostics Manager"
],
"product": "B\u0026R Automation Runtime",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThanOrEqual": "C4.93",
"status": "affected",
"version": "\u003e=3.00",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B\u0026amp;R Automation Runtime versions \u0026gt;=3.00 and \u0026lt;=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.\u003c/span\u003e\n\n"
}
],
"value": "\nA reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B\u0026R Automation Runtime versions \u003e=3.00 and \u003c=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-591",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-591 Reflected XSS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-15T02:14:49.612Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1675607299099-en-original-1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected Cross-Site Scripting Vulnerabilities in Automation Runtime",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2022-4286",
"datePublished": "2023-02-14T14:25:37.538Z",
"dateReserved": "2022-12-05T12:14:29.593Z",
"dateUpdated": "2025-03-20T14:07:56.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-22275 (GCVE-0-2021-22275)
Vulnerability from nvd – Published: 2022-05-13 14:23 – Updated: 2024-08-03 18:37
VLAI?
Summary
Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service.
Severity ?
8.6 (High)
CWE
- CWE-120 - Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Automation | Automation Runtime webserver |
Affected:
unspecified , < 4.91
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T18:37:18.446Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Automation Runtime webserver",
"vendor": "B\u0026R Automation",
"versions": [
{
"lessThan": "4.91",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer Overflow vulnerability in B\u0026R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-13T14:23:20",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial of service vulnerability on Automation Runtime webserver",
"workarounds": [
{
"lang": "en",
"value": "B\u0026R recommends the following specific workarounds and mitigations:\nThe access to the Automation Runtime webserver should be restricted to legitimate network partners, using e.g. a sufficient Firewall setup and robust network segmentation. \nB\u0026R recommends deactivating Automation Runtime webserver when not needed."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@ch.abb.com",
"ID": "CVE-2021-22275",
"STATE": "PUBLIC",
"TITLE": "Denial of service vulnerability on Automation Runtime webserver"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Automation Runtime webserver",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "4.91"
}
]
}
}
]
},
"vendor_name": "B\u0026R Automation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Buffer Overflow vulnerability in B\u0026R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-120 Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf",
"refsource": "MISC",
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1625405588264-en-original-1.0.pdf"
}
]
},
"source": {
"discovery": "UNKNOWN"
},
"work_around": [
{
"lang": "en",
"value": "B\u0026R recommends the following specific workarounds and mitigations:\nThe access to the Automation Runtime webserver should be restricted to legitimate network partners, using e.g. a sufficient Firewall setup and robust network segmentation. \nB\u0026R recommends deactivating Automation Runtime webserver when not needed."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2021-22275",
"datePublished": "2022-05-13T14:23:20",
"dateReserved": "2021-01-05T00:00:00",
"dateUpdated": "2024-08-03T18:37:18.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-11637 (GCVE-0-2020-11637)
Vulnerability from nvd – Published: 2020-10-15 15:08 – Updated: 2024-09-16 16:33
VLAI?
Summary
A memory leak in the TFTP service in B&R Automation Runtime versions <N4.26, <N4.34, <F4.45, <E4.53, <D4.63, <A4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition.
Severity ?
5.8 (Medium)
CWE
- CWE-401 - Improper Release of Memory Before Removing Last Reference
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R | Automation Runtime |
Affected:
unspecified , ≤ 4.1x
(custom)
Affected: 4.2x , < N4.26 (custom) Affected: 4.3x , < N4.34 (custom) Affected: 4.4x , < F4.45 (custom) Affected: 4.5x , < E4.53 (custom) Affected: 4.6x , < D4.63 (custom) Affected: 4.7x , < A4.73 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:35:13.385Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Automation Runtime",
"vendor": "B\u0026R",
"versions": [
{
"lessThanOrEqual": "4.1x",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "N4.26",
"status": "affected",
"version": "4.2x",
"versionType": "custom"
},
{
"lessThan": "N4.34",
"status": "affected",
"version": "4.3x",
"versionType": "custom"
},
{
"lessThan": "F4.45",
"status": "affected",
"version": "4.4x",
"versionType": "custom"
},
{
"lessThan": "E4.53",
"status": "affected",
"version": "4.5x",
"versionType": "custom"
},
{
"lessThan": "D4.63",
"status": "affected",
"version": "4.6x",
"versionType": "custom"
},
{
"lessThan": "A4.73",
"status": "affected",
"version": "4.7x",
"versionType": "custom"
}
]
}
],
"datePublic": "2020-08-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A memory leak in the TFTP service in B\u0026R Automation Runtime versions \u003cN4.26, \u003cN4.34, \u003cF4.45, \u003cE4.53, \u003cD4.63, \u003cA4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401 Improper Release of Memory Before Removing Last Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-10-15T15:08:14",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Automation Runtime TFTP Service DoS Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@ch.abb.com",
"DATE_PUBLIC": "2020-08-12T00:00:00.000Z",
"ID": "CVE-2020-11637",
"STATE": "PUBLIC",
"TITLE": "Automation Runtime TFTP Service DoS Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Automation Runtime",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "4.1x"
},
{
"version_affected": "\u003c",
"version_name": "4.2x",
"version_value": "N4.26"
},
{
"version_affected": "\u003c",
"version_name": "4.3x",
"version_value": "N4.34"
},
{
"version_affected": "\u003c",
"version_name": "4.4x",
"version_value": "F4.45"
},
{
"version_affected": "\u003c",
"version_name": "4.5x",
"version_value": "E4.53"
},
{
"version_affected": "\u003c",
"version_name": "4.6x",
"version_value": "D4.63"
},
{
"version_affected": "\u003c",
"version_name": "4.7x",
"version_value": "A4.73"
}
]
}
}
]
},
"vendor_name": "B\u0026R"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A memory leak in the TFTP service in B\u0026R Automation Runtime versions \u003cN4.26, \u003cN4.34, \u003cF4.45, \u003cE4.53, \u003cD4.63, \u003cA4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-401 Improper Release of Memory Before Removing Last Reference"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf",
"refsource": "MISC",
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1595163815396-de-original-1.0.pdf"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2020-11637",
"datePublished": "2020-10-15T15:08:14.438915Z",
"dateReserved": "2020-04-08T00:00:00",
"dateUpdated": "2024-09-16T16:33:01.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-19108 (GCVE-0-2019-19108)
Vulnerability from nvd – Published: 2020-04-20 21:48 – Updated: 2024-08-05 02:09
VLAI?
Summary
An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP.
Severity ?
9.4 (Critical)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R | Automation Runtime |
Affected:
2 <= 2.96
Affected: 3 <= 3.10 Affected: 4 <= 4.72 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T02:09:39.340Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Automation Runtime",
"vendor": "B\u0026R",
"versions": [
{
"status": "affected",
"version": "2 \u003c= 2.96"
},
{
"status": "affected",
"version": "3 \u003c= 3.10"
},
{
"status": "affected",
"version": "4 \u003c= 4.72"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An authentication weakness in the SNMP service in B\u0026R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B\u0026R products via SNMP."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-27T20:21:55",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "B\u0026R Automation Runtime SNMP Authentication and Authorization Weakness",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cybersecurity@ch.abb.com",
"ID": "CVE-2019-19108",
"STATE": "PUBLIC",
"TITLE": "B\u0026R Automation Runtime SNMP Authentication and Authorization Weakness"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Automation Runtime",
"version": {
"version_data": [
{
"version_value": "2 \u003c= 2.96"
},
{
"version_value": "3 \u003c= 3.10"
},
{
"version_value": "4 \u003c= 4.72"
}
]
}
}
]
},
"vendor_name": "B\u0026R"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An authentication weakness in the SNMP service in B\u0026R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B\u0026R products via SNMP."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-798 Use of Hard-coded Credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/",
"refsource": "CONFIRM",
"url": "https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/"
},
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01",
"refsource": "MISC",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-051-01"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2019-19108",
"datePublished": "2020-04-20T21:48:29",
"dateReserved": "2019-11-18T00:00:00",
"dateUpdated": "2024-08-05T02:09:39.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}