CVE-2024-0323CWE-1240

FTP uses unsecure encryption mechanisms

Critical · published February 5, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

🔥 The FTP server in B&R Automation Runtime is riding on some seriously outdated encryption protocols! Think of it like sending your private love letters through an open window for all to read instead of a secure mailbox. By relying on SSLv3, TLSv1.0, and TLSv1.1, your sensitive data is an easy target for anyone lurking in the vicinity. An attacker could intercept your communications, leading to devastating consequences like data breaches or unauthorized access to sensitive information. In a world where data privacy is paramount, leaving your communications vulnerable puts your entire operation at risk!

Put simply

Think of it like sending your private love letters through an open window for all to read instead of a secure mailbox. By relying on SSLv3, TLSv1.0, and TLSv1.1, your sensitive data is an easy target for anyone lurking in the vicinity. This vulnerability allows a network-based attacker to exploit the insecure FTP server by performing man-in-the-middle attacks, making it possible to decrypt the communications between clients and the server.

What to do

An attacker could intercept your communications, leading to devastating consequences like data breaches or unauthorized access to sensitive information. In a world where data privacy is paramount, leaving your communications vulnerable puts your entire operation at risk! Immediately upgrade your FTP server to utilize strong encryption protocols like TLSv1.2 or higher. Review your network configurations and ensure that older protocols are disabled to prevent exploitation. Regularly audit your systems for security compliance to keep your data safe! You've got this! Take these steps to secure your communications and step into your hero role in the fight against cyber threats! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.1th percentile
Weakness
CWE-1240 · Use of a Cryptographic Primitive with a Risky Implementation
Published
2024-02-05T16:05Z
EPSS history
Timeline
  • 05 FEB 16:05Z
    FTP uses unsecure encryption mechanisms
    cvelistv5