B&R Automation Studio
Successful exploitation of these vulnerabilities could allow an attacker to delete arbitrary files from this system, fetch arbitrary files, or perform arbitrary write operations.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-19102US | high7.5 | — | ||
A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to cert… | ||||
| CVE-2019-19101US | medium5.9 | — | ||
A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.… | ||||
| CVE-2019-19100US | high7.1 | — | ||
A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP, < 4.7.2 and < 4.8.1… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- MitigationAutomation Studio
Access to zip archives is controlled and access of the zip archive is limited to trusted parties only.
- MitigationAutomation Studio
Access to zip archives is controlled and access of the zip archive is limited to trusted parties only.
- MitigationAutomation Studio
Access to zip archives is controlled and access of the zip archive is limited to trusted parties only.
- FixedAutomation Studio
Automation Studio 4.3 and later should be switched from the SharpZipLib to the .NET Framework, provided native ZIP archive implementation. For these versions the issue is not reproducible. For prior versions of Automation Studio, it is recommended to update the installation.
- FixedAutomation Studio
Automation Studio 4.3 and later should be switched from the SharpZipLib to the .NET Framework, provided native ZIP archive implementation. For these versions the issue is not reproducible. For prior versions of Automation Studio, it is recommended to update the installation.
- FixedAutomation Studio
Automation Studio 4.3 and later should be switched from the SharpZipLib to the .NET Framework, provided native ZIP archive implementation. For these versions the issue is not reproducible. For prior versions of Automation Studio, it is recommended to update the installation.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan