Back to Database
Status published
High
CVE-2024-0220
B&R products use insufficient communication encryption
Vulnerability Description
B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-0220
Credits & Attribution
No credits recorded in the NVD database.
More from B&R Industrial Automation
View All →CVE-2025-3450
Automation Runtime SDM requests may impact system
Critical
9.3
CVE-2024-8603
A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability...
High
8.2
CVE-2024-8315
Improper Handling of Insufficient Permissions or Privileges in B&R APROL
Medium
6.8
CVE-2024-5801
IP Forwarding enabled in B&R Automation Runtime
Medium
5.3
CVE-2024-5800
Diffie-Hellman groups with insufficient strength used in SSL/TLS stack of B&R Automation Runtime
High
8.3
Affected Vendor
B&R Industrial Automation
View all reports →Affected Software
Automation Studio, Technology Guarding
Vulnerable Versions:
4.0, 1.0.0
Timeline
Official Publish:
February 22nd, 2024
Last Modified:
September 19th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
MITRE ATT&CK TTPs
T1040
Network Sniffing
Collection
T1557
Adversary-in-the-Middle
Credential Access
T1552
Unsecured Credentials
Credential Access
T1078
Valid Accounts
Persistence
T1071
Application Layer Protocol
Command and Control
T1190
Exploit Public-Facing Application
Initial Access
T1059
Command and Scripting Interpreter
Execution
T1505.003
Web Shell
Persistence
T1105
Ingress Tool Transfer
Command and Control
T1565.002
Stored Data Manipulation
Impact