PT-2022-4238 · B&R · Automation Studio

Published 2022-08-11 · Updated 2022-08-13 · CVE-2021-22289

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions B&R Automation Studio version 4.0 and later

Description The issue is related to improper input validation in the project upload mechanism, which may allow an unauthenticated network attacker to execute code. This could potentially lead to remote code execution or denial of service.

Recommendations For B&R Automation Studio version 4.0 and later, update to a version that includes a fix for the improper input validation vulnerability in the project upload mechanism. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-05087

CVE-2021-22289

Affected Products

Automation Studio

References · 7

• https://osv.dev/vulnerability/CVE-2021-22289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22289 · Security Note
• https://br-automation.com/downloads_br_productcatalogue/assets/1640529306294-en-original-1.0.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05087 · Security Note
• https://t.me/cibsecurity/47965 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-228-05 · Note
• https://t.me/cvenotify/34647 · Telegram Post