CVE-2024-0220

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0220
B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data. Missing Encryption of Sensitive Data, Cleartext Transmission of Sensitive Information, Improper Control of Generation of Code ('Code Injection'), Inadequate Encryption Strength vulnerability in B&R Industrial Automation B&R Automation Studio (Upgrade Service modules), B&R Industrial Automation Technology Guarding.This issue affects B&R Automation Studio: <4.6; Technology Guarding: <1.4.0.

8.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.br-automation.com/fileadmin/SA23P019_Automation_Studio_Upgrade_Service_uses_insufficient_encryption.pdf-1b3b181c.pdf
Configurations

No configuration.

History

22 Feb 2024, 19:07

Type Values Removed Values Added
Summary
  • (es) B&amp;R Automation Studio Upgrade Service y B&amp;R Technology Guarding utilizan criptografía insuficiente para la comunicación con la actualización y los servidores de licencias. Un atacante basado en la red podría aprovechar la vulnerabilidad para ejecutar código arbitrario en los productos o rastrear datos confidenciales. Falta de cifrado de datos confidenciales, transmisión de texto plano de información confidencial, control inadecuado de la generación de código ("inyección de código"), vulnerabilidad de fuerza de cifrado inadecuada en B&amp;R Industrial Automation B&amp;R Automation Studio (módulos de servicio de actualización), B&amp;R Industrial Automation Technology Guarding.Este problema afecta a B&amp;R Automation Studio: &lt;4,6; Protección de tecnología: &lt;1.4.0.

22 Feb 2024, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-22 11:15

Updated : 2024-02-22 19:07

NVD link : CVE-2024-0220

Mitre link : CVE-2024-0220

CVE.ORG link : CVE-2024-0220

JSON object : View

Products Affected

No product.

CWE
CWE-311

Missing Encryption of Sensitive Data

CWE-319

Cleartext Transmission of Sensitive Information

CWE-326

Inadequate Encryption Strength

CWE-94

Improper Control of Generation of Code ('Code Injection')