1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: B&R
- Equipment: Automation Runtime
- Vulnerability: Use of a Broken or Risky Cryptographic Algorithm
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to masquerade as legitimate services on impacted devices.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
B&R reports that the following products are affected:
- B&R Automation Runtime: versions prior to 6.1
- B&R mapp View: versions prior to 6.1
3.2 VULNERABILITY OVERVIEW
3.2.1 USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327
A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions <6.1 and B&R mapp View versions <6.1 may be abused by unauthenticated network-based attackers to masquerade as legitimate services on impacted devices.
CVE-2024-8603 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
3.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: Austria
3.4 RESEARCHER
ABB PSIRT reported this vulnerability to CISA.
4. MITIGATIONS
B&R has identified the following specific workarounds and mitigations users can apply to reduce risk:
- All affected products:
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.This article has been indexed from All CISA AdvisoriesRead the original article: