CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.7 | $0-$5k | 0.00 |
A vulnerability, which was classified as problematic, was found in B&R Industrial Automation Runtime up to 14.92 (Automation Software). Affected is an unknown code of the component FTP Server. The manipulation with an unknown input leads to a risky encryption vulnerability. CWE is classifying the issue as CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. This is going to have an impact on confidentiality. CVE summarizes:
The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected product clients.
The weakness was presented 02/05/2024. The advisory is available at br-automation.com. This vulnerability is traded as CVE-2024-0323 since 01/08/2024. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.
Upgrading to version 14.93 eliminates this vulnerability.
See VDB-202725, VDB-210420, VDB-212013 and VDB-218468 for similar entries.
Product
Type
Vendor
Name
Version
- 14.0
- 14.1
- 14.2
- 14.3
- 14.4
- 14.5
- 14.6
- 14.7
- 14.8
- 14.9
- 14.10
- 14.11
- 14.12
- 14.13
- 14.14
- 14.15
- 14.16
- 14.17
- 14.18
- 14.19
- 14.20
- 14.21
- 14.22
- 14.23
- 14.24
- 14.25
- 14.26
- 14.27
- 14.28
- 14.29
- 14.30
- 14.31
- 14.32
- 14.33
- 14.34
- 14.35
- 14.36
- 14.37
- 14.38
- 14.39
- 14.40
- 14.41
- 14.42
- 14.43
- 14.44
- 14.45
- 14.46
- 14.47
- 14.48
- 14.49
- 14.50
- 14.51
- 14.52
- 14.53
- 14.54
- 14.55
- 14.56
- 14.57
- 14.58
- 14.59
- 14.60
- 14.61
- 14.62
- 14.63
- 14.64
- 14.65
- 14.66
- 14.67
- 14.68
- 14.69
- 14.70
- 14.71
- 14.72
- 14.73
- 14.74
- 14.75
- 14.76
- 14.77
- 14.78
- 14.79
- 14.80
- 14.81
- 14.82
- 14.83
- 14.84
- 14.85
- 14.86
- 14.87
- 14.88
- 14.89
- 14.90
- 14.91
- 14.92
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔒VulDB CVSS-BT Score: 🔒
VulDB Vector: 🔒
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.7VulDB Meta Temp Score: 6.7
VulDB Base Score: 3.7
VulDB Temp Score: 3.6
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA Base Score: 9.8
CNA Vector (Asea Brown Boveri Ltd. (ABB)): 🔒
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: Risky encryptionCWE: CWE-327 / CWE-310
CAPEC: 🔒
ATT&CK: 🔒
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔒
Upgrade: Runtime 14.93
Timeline
01/08/2024 CVE reserved02/05/2024 Advisory disclosed
02/05/2024 VulDB entry created
02/05/2024 VulDB entry last update
Sources
Advisory: br-automation.comStatus: Confirmed
CVE: CVE-2024-0323 (🔒)
See also: 🔒
Entry
Created: 02/05/2024 18:25Changes: 02/05/2024 18:25 (51)
Complete: 🔍
Cache ID: 18:CBA:103
No comments yet. Languages: en.
Please log in to comment.