PT-2024-37164 · Br · B&R Automation Runtime

Published 2024-08-10 · Updated 2024-08-12 · CVE-2024-5800

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: B&R Automation Runtime versions prior to 6.0.2

Description: The issue concerns the use of Diffie-Hellman groups with insufficient strength in the SSL/TLS stack, allowing a network attacker to decrypt the SSL/TLS communication.

Recommendations: For versions prior to 6.0.2, update to version 6.0.2 or later to resolve the issue.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2024-5800

Affected Products

B&R Automation Runtime

References · 4

• https://osv.dev/vulnerability/CVE-2024-5800 · Vendor Advisory
• https://br-automation.com/fileadmin/SA24P011-d8aaf02f.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5800 · Security Note
• https://twitter.com/CveFindCom/status/1822936748860547513 · Twitter Post