Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for B&R VC4 by B&R Industrial Automation

    CVE-2023-1617 (GCVE-0-2023-1617)

    Vulnerability from nvd – Published: 2023-04-14 11:48 – Updated: 2025-02-06 19:48
    VLAI
    Title
    Improper Authentication Mechanism in B&R VC4 Visualization
    Summary
    Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules).  This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization. This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    ABB
    References
    Impacted products
    Vendor Product Version
    B&R Industrial Automation B&R VC4 Affected: 3.* , ≤ 3.96.7 (custom)
    Affected: 4.0* , ≤ 4.06.7 (custom)
    Affected: 4.1* , ≤ 4.16.3 (custom)
    Affected: 4.2* , ≤ 4.26.8 (custom)
    Affected: 4.3* , ≤ 4.34.6 (custom)
    Affected: 4.4* , ≤ 4.45.1 (custom)
    Affected: 4.5* , ≤ 4.45.3 (custom)
    Affected: 4.7* , ≤ 4.72.9 (custom)
    		Create a notification for this product.
    Date Public
    2023-04-13 18:30
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:24.043Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1617",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T19:48:02.341552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-06T19:48:05.890Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "VNC-Server"
          ],
          "product": "B\u0026R VC4",
          "vendor": "B\u0026R Industrial Automation",
          "versions": [
            {
              "lessThanOrEqual": "3.96.7",
              "status": "affected",
              "version": "3.*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.06.7",
              "status": "affected",
              "version": "4.0*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.16.3",
              "status": "affected",
              "version": "4.1*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.26.8",
              "status": "affected",
              "version": "4.2*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.34.6",
              "status": "affected",
              "version": "4.3*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.45.1",
              "status": "affected",
              "version": "4.4*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.45.3",
              "status": "affected",
              "version": "4.5*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.72.9",
              "status": "affected",
              "version": "4.7*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-04-13T18:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Authentication vulnerability in B\u0026amp;R Industrial Automation B\u0026amp;R VC4 (VNC-Server modules).\u0026nbsp; This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\u003cbr\u003e\u003cp\u003eThis issue affects B\u0026amp;R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in B\u0026R Industrial Automation B\u0026R VC4 (VNC-Server modules).\u00a0 This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\nThis issue affects B\u0026R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-14T11:48:53.396Z",
        "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
        "shortName": "ABB"
      },
      "references": [
        {
          "url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Improper Authentication Mechanism in B\u0026R VC4 Visualization",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
    "assignerShortName": "ABB",
    "cveId": "CVE-2023-1617",
    "datePublished": "2023-04-14T11:48:53.396Z",
    "dateReserved": "2023-03-24T07:13:36.844Z",
    "dateUpdated": "2025-02-06T19:48:05.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2023-1617 (GCVE-0-2023-1617)

    Vulnerability from cvelistv5 – Published: 2023-04-14 11:48 – Updated: 2025-02-06 19:48
    VLAI
    Title
    Improper Authentication Mechanism in B&R VC4 Visualization
    Summary
    Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules).  This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization. This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-287 - Improper Authentication
    Assigner
    ABB
    References
    Impacted products
    Vendor Product Version
    B&R Industrial Automation B&R VC4 Affected: 3.* , ≤ 3.96.7 (custom)
    Affected: 4.0* , ≤ 4.06.7 (custom)
    Affected: 4.1* , ≤ 4.16.3 (custom)
    Affected: 4.2* , ≤ 4.26.8 (custom)
    Affected: 4.3* , ≤ 4.34.6 (custom)
    Affected: 4.4* , ≤ 4.45.1 (custom)
    Affected: 4.5* , ≤ 4.45.3 (custom)
    Affected: 4.7* , ≤ 4.72.9 (custom)
    		Create a notification for this product.
    Date Public
    2023-04-13 18:30
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:24.043Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1617",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-06T19:48:02.341552Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-06T19:48:05.890Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "VNC-Server"
          ],
          "product": "B\u0026R VC4",
          "vendor": "B\u0026R Industrial Automation",
          "versions": [
            {
              "lessThanOrEqual": "3.96.7",
              "status": "affected",
              "version": "3.*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.06.7",
              "status": "affected",
              "version": "4.0*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.16.3",
              "status": "affected",
              "version": "4.1*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.26.8",
              "status": "affected",
              "version": "4.2*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.34.6",
              "status": "affected",
              "version": "4.3*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.45.1",
              "status": "affected",
              "version": "4.4*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.45.3",
              "status": "affected",
              "version": "4.5*",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.72.9",
              "status": "affected",
              "version": "4.7*",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2023-04-13T18:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Authentication vulnerability in B\u0026amp;R Industrial Automation B\u0026amp;R VC4 (VNC-Server modules).\u0026nbsp; This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\u003cbr\u003e\u003cp\u003eThis issue affects B\u0026amp;R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\u003c/p\u003e"
            }
          ],
          "value": "Improper Authentication vulnerability in B\u0026R Industrial Automation B\u0026R VC4 (VNC-Server modules).\u00a0 This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization.\nThis issue affects B\u0026R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-14T11:48:53.396Z",
        "orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
        "shortName": "ABB"
      },
      "references": [
        {
          "url": "https://www.br-automation.com/downloads_br_productcatalogue/assets/1681046878970-en-original-1.0.pdf"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Improper Authentication Mechanism in B\u0026R VC4 Visualization",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
    "assignerShortName": "ABB",
    "cveId": "CVE-2023-1617",
    "datePublished": "2023-04-14T11:48:53.396Z",
    "dateReserved": "2023-03-24T07:13:36.844Z",
    "dateUpdated": "2025-02-06T19:48:05.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}