CVE-2024-0220: high-severity vulnerability in B&R Industrial Automation Automation Studio
B&R products use insufficient communication encryption
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
B&R Automation Studio and Technology Guarding products use weak encryption when communicating with their servers, allowing attackers on the network to intercept sensitive information or inject malicious code.
Insufficient cryptographic strength in client-server communication (CWE-319) enables network-based adversaries to perform man-in-the-middle attacks, potentially leading to credential theft, arbitrary code execution (CWE-94), or service compromise. The vulnerability affects upgrade and licensing channels without proper authentication or encryption mechanisms.
In the same product, most dangerous first.