CVE-2019-19101 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2019-19101

Analyzed

More Info Official Page

Source-cybersecurity@ch.abb.com

Published At-29 Apr, 2020 | 03:15

Updated At-03 Nov, 2021 | 17:01

A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.5SP, < 4.6.4 and < 4.7.2 enable unauthenticated users to perform MITM attacks via the B&R upgrade server.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N

CPE Matches

B&R Industrial Automation GmbH

>>automation_studio>>Versions from 4.0(inclusive) to 4.0.29.87(inclusive)

cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*

B&R Industrial Automation GmbH

>>automation_studio>>Versions from 4.1(inclusive) to 4.1.17.113(inclusive)

cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*

B&R Industrial Automation GmbH

>>automation_studio>>Versions from 4.2(inclusive) to 4.2.14.119(inclusive)

cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*

B&R Industrial Automation GmbH

>>automation_studio>>Versions from 4.3(inclusive) to 4.3.11(exclusive)

cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*

B&R Industrial Automation GmbH

>>automation_studio>>Versions from 4.4(inclusive) to 4.4.9(exclusive)

cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*

B&R Industrial Automation GmbH

>>automation_studio>>Versions from 4.5(inclusive) to 4.5.5(exclusive)

cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*

B&R Industrial Automation GmbH

>>automation_studio>>Versions from 4.6(inclusive) to 4.6.4(exclusive)

cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*

B&R Industrial Automation GmbH

>>automation_studio>>Versions from 4.7(inclusive) to 4.7.2(exclusive)

cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-295	Primary	nvd@nist.gov
CWE-326	Secondary	cybersecurity@ch.abb.com

References

Hyperlink	Source	Resource
https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/	cybersecurity@ch.abb.com	Broken Link Vendor Advisory