CVE-2020-24681 - CVE House
Back to Database
Status published High CVE-2020-24681

Automation Studio and PVI Multiple incorrect permission assignments for services

Vulnerability Description

Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalation.This issue affects Automation Studio: from 4.6.0 through 4.6.X, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-24681

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • B&R would like to thank the following for working with us to help protect our customers: Mr. Andrew Hofmans

References

More from B&R Industrial Automation

View All →
CVE-2025-3450
Automation Runtime SDM requests may impact system
Critical 9.3
CVE-2024-8603
A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability...
High 8.2
CVE-2024-8315
Improper Handling of Insufficient Permissions or Privileges in B&R APROL
Medium 6.8
CVE-2024-5801
IP Forwarding enabled in B&R Automation Runtime
Medium 5.3
CVE-2024-5800
Diffie-Hellman groups with insufficient strength used in SSL/TLS stack of B&R Automation Runtime
High 8.3

Affected Vendor

B&R Industrial Automation

View all reports →

Affected Software

Automation Studio, NET/PVI
Vulnerable Versions:
4.6.0, 4.7.0, 4.8.0, 4.9.0

Timeline

Official Publish: February 2nd, 2024
Last Modified: May 9th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-732

MITRE ATT&CK TTPs

T1222 File and Directory Permissions Modification
Defense Evasion
T1574 Hijack Execution Flow
Privilege Escalation
T1005 Data from Local System
Collection
T1078 Valid Accounts
Persistence
T1562 Impair Defenses
Defense Evasion