CVE-2019-19101CWE-326

Incomplete communication encryption and validation in B&R Automation Studio upgrade service

Medium · published April 29, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.5SP, < 4.6.4 and < 4.7.2 enable unauthenticated users to perform MITM attacks via the B&R upgrade server.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00528 · 43.9th percentile
Weakness
CWE-326 · Inadequate Encryption Strength
Published
2020-04-29T02:07Z
EPSS history
Timeline
  • 29 APR 02:07Z
    Incomplete communication encryption and validation in B&R Automation Studio upgrade service
    cvelistv5