title: B&R products use insufficient communication encryption
description:
B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data.
Missing Encryption of Sensitive Data, Cleartext Transmission of Sensitive Information, Improper Control of Generation of Code ('Code Injection'), Inadequate Encryption Strength vulnerability in B&R Industrial Automation B&R Automation Studio (Upgrade Service modules), B&R Industrial Automation Technology Guarding.This issue affects B&R Automation Studio: <4.6; Technology Guarding: <1.4.0.
problem types: CWE-311 Missing Encryption of Sensitive Data
affected:
{
defaultStatus: unaffected
modules: Upgrade Service
product: Automation Studio
vendor: B&R Industrial Automation
versions:
lessThan: 4.6, status: affected, version: 4.0, versionType: patch
}
{
defaultStatus: unaffected
product: Technology Guarding
vendor: B&R Industrial Automation
versions:
lessThan: 1.4.0, status: affected, version: 1.0.0, versionType: patch
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL