Improper Server Certificate Validation in Automation Studio
Priority LOW 39CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.
Summary
An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed B&R Automation Studio (B&R Industrial Automation GmbH): 6.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| B&R Industrial Automation | B&R Automation Studio | 4; 6 to before 6.5 | 6.5 | Patch available | CNA |
- B&R Automation Studio VendorB&R Industrial Automation Affected 4; 6 to before 6.5 Fixed in 6.5 Patch available CNA
Remediation
- Fix · CNA B&R Automation Studio (B&R Industrial Automation GmbH) Fixed in 6.5
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11043
- 2026-10-03 Alias added: GHSA-67wp-8rc4-mvrw
References
More B&R Industrial Automation vulnerabilities
- TI-2023-01522 Improper Authentication Mechanism in B&R VC4 Visualization CVSS 3.1CRITICAL 9.8
- TI-2022-21498 Buffer overflow when changing configuration on Tbase Server CVSS 3.1CRITICAL 9.8
- TI-2022-21496 Memory leak when receiving messages in APROL Tbase server CVSS 3.1CRITICAL 9.8
- TI-2022-21495 Lack of authentication when managing APROL database CVSS 3.1CRITICAL 9.4
- TI-2024-30523 Unauthorized local file reading in B&R APROL CVSS 4.0CRITICAL 9.2
- TI-2024-00297 FTP uses unsecure encryption mechanisms CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-11043 · CVE Program
- CVE-2025-11043 · NVD
- FIRST EPSS
- GHSA-67wp-8rc4-mvrw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences