CVE-2024-10490
High
Description
An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions. B&R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.
SeverityHigh
CVSS8.4
Exploit probability42. percentile0.5%
ProductB&R mapp Cockpit
PublishedDec 2, 2024
First seenDec 2, 2024
Weakness typeCWE-288CWE-288
How to fix
Update
- B&R Industrial Automation GmbH B&R mapp Cockpit6.0;0 or later
- B&R Industrial Automation GmbH B&R mapp View6.0 or later
- B&R Industrial Automation GmbH B&R mapp Services6.0 or later
- B&R Industrial Automation GmbH B&R mapp Motion6.0 or later
- B&R Industrial Automation GmbH B&R mapp Vision6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| B&R Industrial Automation GmbH B&R mapp Cockpit | 5.0;0 ≤ v < 6.0;0 | 6.0;0 |
| B&R Industrial Automation GmbH B&R mapp View | 5.0 ≤ v < 6.0 | 6.0 |
| B&R Industrial Automation GmbH B&R mapp Services | 5.0 ≤ v < 6.0 | 6.0 |
| B&R Industrial Automation GmbH B&R mapp Motion | 5.0 ≤ v < 6.0 | 6.0 |
| B&R Industrial Automation GmbH B&R mapp Vision | 5.0 ≤ v < 6.0 | 6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.