Description
An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-20-051-01
Scores
CVSS v3
9.4
EPSS
0.0165
EPSS Percentile
73.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Details
CWE
CWE-798
Status
published
Products (14)
br-automation/automation_runtime
2.96
br-automation/automation_runtime
3.00
br-automation/automation_runtime
3.01
br-automation/automation_runtime
3.06
br-automation/automation_runtime
3.07
br-automation/automation_runtime
4.72
br-automation/automation_runtime
3.08 - 3.10
br-automation/automation_studio
2.7
br-automation/automation_studio
3.0.71
br-automation/automation_studio
3.0.80
... and 4 more
Published
Apr 20, 2020
Tracked Since
Feb 18, 2026