CVE-2024-0220 — B&R products use insufficient communication encryption

Description (CNA)

B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data.

Affected (CNA)

Vendor / product	Versions
B&R Industrial Automation / Automation Studio	affected 4.0 before 4.6
B&R Industrial Automation / Technology Guarding	affected 1.0.0 before 1.4.0

CWE

CWE-1240, CWE-319, CWE-94

References

https://www.br-automation.com/fileadmin/SA23P019_Automation_Studio_Upgrade_Service_uses_insufficient_encryption.pdf-1b3b181c.pdf

ADP enrichment

CVE

No English description supplied.

https://www.br-automation.com/fileadmin/SA23P019_Automation_Studio_Upgrade_Service_uses_insufficient_encryption.pdf-1b3b181c.pdf

CISA-ADP

No English description supplied.

No references supplied.