title: Denial of service vulnerability on Automation Runtime webserver
description: Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service.
problem types: CWE-120 Buffer Overflow
affected:
{
product: Automation Runtime webserver
vendor: B&R Automation
versions:
lessThan: 4.91, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
]
workarounds: B&R recommends the following specific workarounds and mitigations:
The access to the Automation Runtime webserver should be restricted to legitimate network partners, using e.g. a sufficient Firewall setup and robust network segmentation.
B&R recommends deactivating Automation Runtime webserver when not needed.