PT-2023-1741 · B&R · B&R Aprol Tbase Server

Published 2023-02-08 · Updated 2023-02-18 · CVE-2022-43762

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions B&R APROL Tbase server versions prior to R 4.2-07

Description The issue is caused by a lack of verification in the B&R APROL Tbase server, which may lead to memory leaks when receiving messages. This can be exploited by a remote attacker to execute arbitrary code due to a buffer overflow operation.

Recommendations For versions prior to R 4.2-07, update to version R 4.2-07 or later to resolve the issue. As a temporary workaround, consider restricting access to the Tbase server to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2023-01334

CVE-2022-43762

Affected Products

B&R Aprol Tbase Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-43762 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43762 · Vendor Advisory
• https://br-automation.com/downloads_br_productcatalogue/assets/1674823095245-en-original-1.0.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01334 · Security Note
• https://vuldb.com/ru/?id.220431 · Note
• https://t.me/cibsecurity/57765 · Telegram Post