PT-2024-10877 · B&R Industrial Automation · Automation Studio

Published 2024-02-01 · Updated 2024-02-10 · CVE-2021-22282

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions B&R Industrial Automation Automation Studio versions 4.0 through 4.12

Description The issue is related to an improper control of generation of code, also known as 'Code Injection', which allows for local execution of code. This is due to an improper copy algorithm in the project extraction component. An unauthenticated attacker may be able to execute code.

Recommendations For Automation Studio versions 4.0 through 4.12, update to a version that fixes the improper copy algorithm issue to prevent code injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-22282

Affected Products

Automation Studio

References · 6

• https://br-automation.com/fileadmin/2021-12_RCE_Vulnerability_in_BnR_Automation_Studio-1b993aeb.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22282 · Security Note
• https://twitter.com/CVEnew/status/1753310607959556153 · Twitter Post
• https://t.me/cvenotify/70930 · Telegram Post
• https://t.me/cvenotify/69740 · Telegram Post