Read the docs
TI-2020-09343 Aliases CVE-2020-11644GHSA-whcf-97gv-r7vw

GateManager Audit Message Spoofing Vulnerability

Priority LOW 31CWE-117Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The information disclosure vulnerability present in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated users to generate fake audit log messages.

Why it matters now

EPSS 0.01198 68th percentileScored 2026-11-08
Fix Fixed GateManager (B&R): 9.0.20262, 9.2.620236042

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
B&R Industrial AutomationGateManager4260 to before 9.0.20262; 9250 to before 9.0.20262; 8250 to before 9.2.6202360429.0.20262, 9.2.620236042Patch availableCNA
  • GateManager VendorB&R Industrial Automation Affected 4260 to before 9.0.20262; 9250 to before 9.0.20262; 8250 to before 9.2.620236042 Fixed in 9.0.20262, 9.2.620236042 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:br-automation:gatemanager_9250_firmware:*:*:*:*:*:*:*:*before 9.0.20262VulnerableB&R Industrial Automation
cpe:2.3:h:br-automation:gatemanager_9250:-:*:*:*:*:*:*:*not specified by NVDRunning onB&R Industrial Automation
cpe:2.3:o:br-automation:gatemanager_4260_firmware:*:*:*:*:*:*:*:*before 9.0.20262VulnerableB&R Industrial Automation
cpe:2.3:h:br-automation:gatemanager_4260:-:*:*:*:*:*:*:*not specified by NVDRunning onB&R Industrial Automation
cpe:2.3:o:br-automation:gatemanager_8250_firmware:*:*:*:*:*:*:*:*before 9.2.620236042VulnerableB&R Industrial Automation
cpe:2.3:h:br-automation:gatemanager_8250:-:*:*:*:*:*:*:*not specified by NVDRunning onB&R Industrial Automation
  • cpe:2.3:o:br-automation:gatemanager_9250_firmware:*:*:*:*:*:*:*:* Versions before 9.0.20262 Vulnerable ·B&R Industrial Automation
  • cpe:2.3:h:br-automation:gatemanager_9250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·B&R Industrial Automation
  • cpe:2.3:o:br-automation:gatemanager_4260_firmware:*:*:*:*:*:*:*:* Versions before 9.0.20262 Vulnerable ·B&R Industrial Automation
  • cpe:2.3:h:br-automation:gatemanager_4260:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·B&R Industrial Automation
  • cpe:2.3:o:br-automation:gatemanager_8250_firmware:*:*:*:*:*:*:*:* Versions before 9.2.620236042 Vulnerable ·B&R Industrial Automation
  • cpe:2.3:h:br-automation:gatemanager_8250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·B&R Industrial Automation

Remediation

  • Fix · CNA GateManager (B&R) Fixed in 9.0.20262, 9.2.620236042

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    B&R GateManager 9.0.20262, 9.2.620236042

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2020-09344 GateManager Denial of Service VulnerabilityPriority LOW 32
    • TI-2020-09342 GateManager Information Disclosure VulnerabilityPriority LOW 31
    • TI-2020-09345 GateManager Log Information Disclosure VulnerabilityPriority LOW 22
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11644
  2. 2026-10-03 Alias added: GHSA-whcf-97gv-r7vw

References

Advisory 2

  • TI-2020-09344 GateManager Denial of Service Vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2020-09342 GateManager Information Disclosure Vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2020-09345 GateManager Log Information Disclosure Vulnerability CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences