CVE-2024-2637
Description
An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.
How to fix
- B&R Industrial Automation Scene Viewer4.4.0 or later
- B&R Industrial Automation Automation RuntimeJ4.93 or later
- B&R Industrial Automation mapp Vision5.26.1 or later
- B&R Industrial Automation mapp View5.24.2 or later
- B&R Industrial Automation mapp Cockpit5.24.2 or later
- B&R Industrial Automation mapp Safety5.24.2 or later
- B&R Industrial Automation VC44.73.2 or later
- B&R Industrial Automation APROL4.4-01 or later
- B&R Industrial Automation CAN Driver1.1.0 or later
- B&R Industrial Automation CAN Driver CC7703.3.0 or later
- B&R Industrial Automation CAN Driver SJA10001.3.0 or later
- B&R Industrial Automation Tou0ch Lock2.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| B&R Industrial Automation Scene Viewer | v < 4.4.0 | 4.4.0 |
| B&R Industrial Automation Automation Runtime | v < J4.93 | J4.93 |
| B&R Industrial Automation mapp Vision | v < 5.26.1 | 5.26.1 |
| B&R Industrial Automation mapp View | v < 5.24.2 | 5.24.2 |
| B&R Industrial Automation mapp Cockpit | v < 5.24.2 | 5.24.2 |
| B&R Industrial Automation mapp Safety | v < 5.24.2 | 5.24.2 |
| B&R Industrial Automation VC4 | v < 4.73.2 | 4.73.2 |
| B&R Industrial Automation APROL | v < 4.4-01 | 4.4-01 |
| B&R Industrial Automation CAN Driver | v < 1.1.0 | 1.1.0 |
| B&R Industrial Automation CAN Driver CC770 | v < 3.3.0 | 3.3.0 |
| B&R Industrial Automation CAN Driver SJA1000 | v < 1.3.0 | 1.3.0 |
| B&R Industrial Automation Tou0ch Lock | v < 2.1.0 | 2.1.0 |
| B&R Industrial Automation B&R Single-Touch Driver | v < 2.0.0 | 2.0.0 |
| B&R Industrial Automation Serial User Mode Touch Driver | v < 1.7.1 | 1.7.1 |
| B&R Industrial Automation Windows Settings Changer (LTSC) | v < 3.2.0 | 3.2.0 |
| B&R Industrial Automation Windows Settings Changer (2019 LTSC) | v < 2.2.0 | 2.2.0 |
| B&R Industrial Automation Windows 10 Recovery Solution | v < 3.2.0 | 3.2.0 |
| B&R Industrial Automation ADI driver universal | v < 3.2.0 | 3.2.0 |
| B&R Industrial Automation ADI Development Kit | v < 5.5.0 | 5.5.0 |
| B&R Industrial Automation ADI .NET SDK | v < 4.1.0 | 4.1.0 |
| B&R Industrial Automation SRAM driver | v < 1.2.0 | 1.2.0 |
| B&R Industrial Automation HMI Service Center | v < 3.1.0 | 3.1.0 |
| B&R Industrial Automation HMI Service Center Maintenance | v < 2.1.0 | 2.1.0 |
| B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC | v ≤ 1.1 | — |
| B&R Industrial Automation KCF Editor | v < 1.1.0 | 1.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.