PT-2024-21372 · B&R Industrial Automation · Mapp Cockpit+6

Published 2024-05-14 · Updated 2025-04-24 · CVE-2024-2637

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions B&R Industrial Automation Scene Viewer versions prior to 4.4.0 B&R Industrial Automation Automation Runtime versions prior to J4.93 B&R Industrial Automation mapp Vision versions prior to 5.26.1 B&R Industrial Automation mapp View versions prior to 5.24.2 B&R Industrial Automation mapp Cockpit versions prior to 5.24.2 B&R Industrial Automation mapp Safety versions prior to 5.24.2 B&R Industrial Automation VC4 versions prior to 4.73.2

Description An Uncontrolled Search Path Element issue could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path.

Recommendations For Scene Viewer versions prior to 4.4.0, update to version 4.4.0 or later. For Automation Runtime versions prior to J4.93, update to version J4.93 or later. For mapp Vision versions prior to 5.26.1, update to version 5.26.1 or later. For mapp View versions prior to 5.24.2, update to version 5.24.2 or later. For mapp Cockpit versions prior to 5.24.2, update to version 5.24.2 or later. For mapp Safety versions prior to 5.24.2, update to version 5.24.2 or later. For VC4 versions prior to 4.73.2, update to version 4.73.2 or later.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2024-2637

Affected Products

B&R Automation Runtime

Scene Viewer

Vc4

Mapp Cockpit

Mapp Safety

Mapp View

Mapp Vision

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-2637 · Security Note
• https://br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf · Note
• https://t.me/cvenotify/119627 · Telegram Post