Lucene search

ABBCVE-2020-24682

HistoryFeb 02, 2024 - 8:15 a.m.

CVE-2020-24682

2024-02-0208:15:45

CWE-428

ABB

web.nvd.nist.gov

cve

vulnerability

b&r industrial automation

automation studio

net/pvi

unquoted search path

elevated privileges

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

9.0%

JSON

Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from 4.9.0 before 4.9.4.

Affected configurations

Nvd

Node

br-automationautomation_studioRange<4.7.7.74

br-automationautomation_studioRange4.8–4.8.6.30

br-automationautomation_studioRange4.9–4.9.4.92

AND

microsoftwindowsMatch-

Node

br-automationautomation_net\/pviRange4.0–4.7.7

br-automationautomation_net\/pviRange4.8–4.8.6

br-automationautomation_net\/pviRange4.9–4.9.4

AND

microsoftwindowsMatch-

VendorProductVersionCPE
br-automationautomation_studio*cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
br-automationautomation_net\/pvi*cpe:2.3:a:br-automation:automation_net\/pvi:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
br-automation	automation_studio	*	cpe:2.3:a:br-automation:automation_studio::::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
br-automation	automation_net\/pvi	*	cpe:2.3:a:br-automation:automation_net\/pvi::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Automation Studio",
    "vendor": "B&R Industrial Automation",
    "versions": [
      {
        "lessThanOrEqual": "4.6",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.7.7 SP",
        "status": "affected",
        "version": "4.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.8.6 SP",
        "status": "affected",
        "version": "4.8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.9.4 SP",
        "status": "affected",
        "version": "4.9.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NET/PVI",
    "vendor": "B&R Industrial Automation",
    "versions": [
      {
        "lessThanOrEqual": "4.6",
        "status": "affected",
        "version": "4.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.7.7",
        "status": "affected",
        "version": "4.7.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.8.6",
        "status": "affected",
        "version": "4.8.0",
        "versionType": "custom"
      },
      {
        "lessThan": "4.9.4",
        "status": "affected",
        "version": "4.9.0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.br-automation.com/fileadmin/2021-14-BR-AS-NET-PVI-Service-Issues-c3710fbf.pdf

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2020-24682