We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Ok

THREATINT
PUBLISHED

CVE-2024-2637

Insecure Loading of Code in B&R Products

Reserved:2024-03-19
Published:2024-05-14
Updated:2024-05-14

Description

An authenticated local attacker who successfully exploited this vulnerability could insert and run arbitrary code using legitimate B&R software's. An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial  Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4 could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path. This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2.



HIGH: 7.2CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Problem types

CWE-427 Uncontrolled Search Path Element

Product status

Default status
unaffected

Any version before 4.4.0
affected

Default status
unaffected

Any version before J4.93
affected

Default status
unaffected

Any version before 5.26.1
affected

Default status
unaffected

Any version before 5.24.2
affected

Default status
unaffected

Any version before 5.24.2
affected

Default status
unaffected

Any version before 5.24.2
affected

Default status
unaffected

Any version before 4.73.2
affected

References

https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf

cve.org CVE-2024-2637

nvd.nist.gov CVE-2024-2637

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-2637