Read the docs

B&R Industrial Automation

Records69All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical15CVSS 9.0–10.0
CVSS high34CVSS 7.0–8.9

Exploited now

B&R Industrial Automation records in CISA KEV

No B&R Industrial Automation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Industrial Automation Aprol 16 records MEDIUM Automation Studio 10 records MEDIUM Automation Runtime 8 records MEDIUM Gatemanager 4260 Firmware 4 records LOW Gatemanager 8250 Firmware 4 records LOW Gatemanager 9250 Firmware 4 records LOW Sitemanager 2 records LOW Automation Net/pvi 1 record LOW

Records

8 records in Automation Runtime · all components

TI-2024-00297 CVE-2024-0323 · GHSA-4v2m-666w-ffm3

FTP uses unsecure encryption mechanisms

Priority MEDIUM 48

The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0023 Published 2024-02-05 Fixed in 14.93 CWE-1240
TI-2023-03038 CVE-2023-3242 · GHSA-j6jr-gfxc-3pp6

Resource allocation without limits in B&R Automation Runtime

Priority MEDIUM 44

Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated network-based attackers to cause permanent denial-of-service conditions.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00542 Published 2023-07-26 No fix listed CWE-665
TI-2019-13790 CVE-2019-19108 · GHSA-wrx9-6qv7-wvvw

B&R Automation Runtime SNMP Authentication and Authorization Weakness

Priority MEDIUM 44

An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via…

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.01645 Published 2020-04-20 No fix listed CWE-798
TI-2021-05253 CVE-2021-22275 · GHSA-r593-v4g4-3636

Denial of service vulnerability on Automation Runtime webserver

Priority LOW 39

Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00961 Published 2022-05-13 Fixed in 4.91 CWE-120
TI-2020-09337 CVE-2020-11637 · GHSA-7j7h-vfmh-v8jc

Automation Runtime TFTP Service DoS Vulnerability

Priority LOW 35

A memory leak in the TFTP service in B&R Automation Runtime versions <N4.26, <N4.34, <F4.45, <E4.53, <D4.63, <A4.73 and prior could allow an unauthenticated attacker with network access to cause a denial of service (DoS)…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01092 Published 2020-10-15 Fixed in N4.26, N4.34 +4 CWE-401
TI-2022-03925 CVE-2022-4286 · GHSA-44gw-qhmf-cxr6

Reflected Cross-Site Scripting Vulnerabilities in Automation Runtime

Priority LOW 28

A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the contex…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00564 Published 2023-02-14 No fix listed CWE-79
TI-2023-05552 CVE-2023-6028 · GHSA-gwp7-vjfg-ffh8

SDM Web interface vulnerable to XSS

Priority LOW 27

A reflected cross-site scripting (XSS) vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions <= G4.93 that enables a remote attacker to execute arbitrary JavaScript code…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00368 Published 2024-02-05 Fixed in 14.93 CWE-79
Open these records in search →