Code injection

2024-02-2211:15:00

PRIOn knowledge base

www.prio-n.com

code injection

inadequate encryption

sensitive data transmission

software version

network-based attack

8.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data.

Missing Encryption of Sensitive Data, Cleartext Transmission of Sensitive Information, Improper Control of Generation of Code (‘Code Injection’), Inadequate Encryption Strength vulnerability in B&R Industrial Automation B&R Automation Studio (Upgrade Service modules), B&R Industrial Automation Technology Guarding.This issue affects B&R Automation Studio: <4.6; Technology Guarding: <1.4.0.