B&R Automation Runtime
An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability may masquerade as services on affected devices.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-8603US | —OT elevated | — | ||
A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp View versions before 6.1… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-25-028-01 JSONself
- Recommended Practicesexternal
- Recommended practices can be found in the following documents: Defense in Depth for B&R products
- B&R Advisory Link
- ICS Advisory ICSA-25-028-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (2)
- FixedB&R Automation Runtime
The problem is corrected in the following product versions: B&R Automation Runtime version 6.1 and B&R mapp View 6.1. B&R recommends that customers apply the update at their earliest convenience if B&R Automation Runtime or B&R mapp View is used to generate self-signed certificates on production machines.
- FixedB&R mapp View
The problem is corrected in the following product versions: B&R Automation Runtime version 6.1 and B&R mapp View 6.1. B&R recommends that customers apply the update at their earliest convenience if B&R Automation Runtime or B&R mapp View is used to generate self-signed certificates on production machines.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan