Search criteria
3 vulnerabilities found for vc4 by br-automation
FKIE_CVE-2023-1617
Vulnerability from fkie_nvd - Published: 2023-04-14 12:15 - Updated: 2024-11-21 07:39
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.
This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| br-automation | vc4 | * | |
| br-automation | vc4 | * | |
| br-automation | vc4 | * | |
| br-automation | vc4 | * | |
| br-automation | vc4 | * | |
| br-automation | vc4 | * | |
| br-automation | vc4 | * | |
| br-automation | vc4 | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C94CCB17-792C-4B9E-9EB2-5AC0888CF3DB",
"versionEndExcluding": "3.96.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*",
"matchCriteriaId": "96C5BD56-2064-4219-970C-8AEDA8F85D20",
"versionEndIncluding": "4.06.4",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EF05318D-11E2-40D4-9556-8A83D0B6ABEB",
"versionEndIncluding": "4.16.3",
"versionStartIncluding": "4.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*",
"matchCriteriaId": "115D84EC-19BD-4CAD-9BAD-6FE9A56E14A1",
"versionEndIncluding": "4.26.8",
"versionStartIncluding": "4.20.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B28066C3-3BF0-4D87-B847-7DA3F126E39F",
"versionEndExcluding": "4.34.7",
"versionStartIncluding": "4.30.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7C048F8F-7D8F-4CC3-91F9-631A3F96A533",
"versionEndIncluding": "4.45.1",
"versionStartIncluding": "4.40.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A56A6BDA-4BC1-4D06-98F2-8CE089F07E3D",
"versionEndIncluding": "4.53.0",
"versionStartIncluding": "4.50.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2E56F00F-57F9-407E-92A4-E03CDD074522",
"versionEndExcluding": "4.73.0",
"versionStartIncluding": "4.70.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper Authentication vulnerability in B\u0026R Industrial Automation B\u0026R VC4 (VNC-Server modules).\u00a0 This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\nThis issue affects B\u0026R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\n\n"
}
],
"id": "CVE-2023-1617",
"lastModified": "2024-11-21T07:39:33.027",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-04-14T12:15:07.377",
"references": [
{
"source": "cybersecurity@ch.abb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
}
],
"sourceIdentifier": "cybersecurity@ch.abb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "cybersecurity@ch.abb.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2023-1617 (GCVE-0-2023-1617)
Vulnerability from cvelistv5 – Published: 2023-04-14 11:48 – Updated: 2025-02-06 19:48
VLAI?
Title
Improper Authentication Mechanism in B&R VC4 Visualization
Summary
Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.
This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.
Severity ?
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | B&R VC4 |
Affected:
3.* , ≤ 3.96.7
(custom)
Affected: 4.0* , ≤ 4.06.7 (custom) Affected: 4.1* , ≤ 4.16.3 (custom) Affected: 4.2* , ≤ 4.26.8 (custom) Affected: 4.3* , ≤ 4.34.6 (custom) Affected: 4.4* , ≤ 4.45.1 (custom) Affected: 4.5* , ≤ 4.45.3 (custom) Affected: 4.7* , ≤ 4.72.9 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.043Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1617",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-06T19:48:02.341552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-06T19:48:05.890Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"VNC-Server"
],
"product": "B\u0026R VC4",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThanOrEqual": "3.96.7",
"status": "affected",
"version": "3.*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.06.7",
"status": "affected",
"version": "4.0*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.16.3",
"status": "affected",
"version": "4.1*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.26.8",
"status": "affected",
"version": "4.2*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.6",
"status": "affected",
"version": "4.3*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.45.1",
"status": "affected",
"version": "4.4*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.45.3",
"status": "affected",
"version": "4.5*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.72.9",
"status": "affected",
"version": "4.7*",
"versionType": "custom"
}
]
}
],
"datePublic": "2023-04-13T18:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Authentication vulnerability in B\u0026amp;R Industrial Automation B\u0026amp;R VC4 (VNC-Server modules).\u0026nbsp; This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\u003cbr\u003e\u003cp\u003eThis issue affects B\u0026amp;R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\u003c/p\u003e"
}
],
"value": "Improper Authentication vulnerability in B\u0026R Industrial Automation B\u0026R VC4 (VNC-Server modules).\u00a0 This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\nThis issue affects B\u0026R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-14T11:48:53.396Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper Authentication Mechanism in B\u0026R VC4 Visualization",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2023-1617",
"datePublished": "2023-04-14T11:48:53.396Z",
"dateReserved": "2023-03-24T07:13:36.844Z",
"dateUpdated": "2025-02-06T19:48:05.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1617 (GCVE-0-2023-1617)
Vulnerability from nvd – Published: 2023-04-14 11:48 – Updated: 2025-02-06 19:48
VLAI?
Title
Improper Authentication Mechanism in B&R VC4 Visualization
Summary
Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.
This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.
Severity ?
9.8 (Critical)
CWE
- CWE-287 - Improper Authentication
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| B&R Industrial Automation | B&R VC4 |
Affected:
3.* , ≤ 3.96.7
(custom)
Affected: 4.0* , ≤ 4.06.7 (custom) Affected: 4.1* , ≤ 4.16.3 (custom) Affected: 4.2* , ≤ 4.26.8 (custom) Affected: 4.3* , ≤ 4.34.6 (custom) Affected: 4.4* , ≤ 4.45.1 (custom) Affected: 4.5* , ≤ 4.45.3 (custom) Affected: 4.7* , ≤ 4.72.9 (custom) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.043Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1617",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-06T19:48:02.341552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-06T19:48:05.890Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"VNC-Server"
],
"product": "B\u0026R VC4",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThanOrEqual": "3.96.7",
"status": "affected",
"version": "3.*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.06.7",
"status": "affected",
"version": "4.0*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.16.3",
"status": "affected",
"version": "4.1*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.26.8",
"status": "affected",
"version": "4.2*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.6",
"status": "affected",
"version": "4.3*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.45.1",
"status": "affected",
"version": "4.4*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.45.3",
"status": "affected",
"version": "4.5*",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.72.9",
"status": "affected",
"version": "4.7*",
"versionType": "custom"
}
]
}
],
"datePublic": "2023-04-13T18:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Authentication vulnerability in B\u0026amp;R Industrial Automation B\u0026amp;R VC4 (VNC-Server modules).\u0026nbsp; This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\u003cbr\u003e\u003cp\u003eThis issue affects B\u0026amp;R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\u003c/p\u003e"
}
],
"value": "Improper Authentication vulnerability in B\u0026R Industrial Automation B\u0026R VC4 (VNC-Server modules).\u00a0 This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\nThis issue affects B\u0026R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-14T11:48:53.396Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper Authentication Mechanism in B\u0026R VC4 Visualization",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2023-1617",
"datePublished": "2023-04-14T11:48:53.396Z",
"dateReserved": "2023-03-24T07:13:36.844Z",
"dateUpdated": "2025-02-06T19:48:05.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}