An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00044.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
B&R Industrial Automation Scene Viewer unaffected
Version Status Constraints
0 affected
< 4.4.0
B&R Industrial Automation Automation Runtime unaffected
Version Status Constraints
0 affected
< J4.93
B&R Industrial Automation mapp Vision unaffected
Version Status Constraints
0 affected
< 5.26.1
B&R Industrial Automation mapp View unaffected
Version Status Constraints
0 affected
< 5.24.2
B&R Industrial Automation mapp Cockpit unaffected
Version Status Constraints
0 affected
< 5.24.2
B&R Industrial Automation mapp Safety unaffected
Version Status Constraints
0 affected
< 5.24.2
B&R Industrial Automation VC4 unaffected
Version Status Constraints
0 affected
< 4.73.2
B&R Industrial Automation APROL unaffected
Version Status Constraints
0 affected
< 4.4-01
B&R Industrial Automation CAN Driver unaffected
Version Status Constraints
0 affected
< 1.1.0
B&R Industrial Automation CAN Driver CC770 unaffected
Version Status Constraints
0 affected
< 3.3.0
B&R Industrial Automation CAN Driver SJA1000 unaffected
Version Status Constraints
0 affected
< 1.3.0
B&R Industrial Automation Tou0ch Lock unaffected
Version Status Constraints
0 affected
< 2.1.0
B&R Industrial Automation B&R Single-Touch Driver unaffected
Version Status Constraints
0 affected
< 2.0.0
B&R Industrial Automation Serial User Mode Touch Driver unaffected
Version Status Constraints
0 affected
< 1.7.1
B&R Industrial Automation Windows Settings Changer (LTSC) unaffected
Version Status Constraints
0 affected
< 3.2.0
B&R Industrial Automation Windows Settings Changer (2019 LTSC) unaffected
Version Status Constraints
0 affected
< 2.2.0
B&R Industrial Automation Windows 10 Recovery Solution unaffected
Version Status Constraints
0 affected
< 3.2.0
B&R Industrial Automation ADI driver universal unaffected
Version Status Constraints
0 affected
< 3.2.0
B&R Industrial Automation ADI Development Kit unaffected
Version Status Constraints
0 affected
< 5.5.0
B&R Industrial Automation ADI .NET SDK unaffected
Version Status Constraints
0 affected
< 4.1.0
B&R Industrial Automation SRAM driver unaffected
Version Status Constraints
0 affected
< 1.2.0
B&R Industrial Automation HMI Service Center unaffected
Version Status Constraints
0 affected
< 3.1.0
B&R Industrial Automation HMI Service Center Maintenance unaffected
Version Status Constraints
0 affected
< 2.1.0
B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC unaffected
Version Status Constraints
0 affected
≤ 1.1
B&R Industrial Automation KCF Editor unaffected
Version Status Constraints
0 affected
< 1.1.0

No data.

No data.

No data.

Subscriptions

Vendors Products
Br-automation Subscribe
Automation Runtime Subscribe
Mapp Cockpit Subscribe
Mapp View Subscribe
Mapp Vision Subscribe
Scene Viewer Subscribe
Vc4 Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-27586 An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf cve-icon cve-icon
History

Thu, 24 Apr 2025 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Br-automation
Br-automation automation Runtime
Br-automation mapp Cockpit
Br-automation mapp View
Br-automation mapp Vision
Br-automation scene Viewer
Br-automation vc4
CPEs cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*
cpe:2.3:a:br-automation:mapp_cockpit:*:*:*:*:*:*:*:*
cpe:2.3:a:br-automation:mapp_view:*:*:*:*:*:*:*:*
cpe:2.3:a:br-automation:mapp_vision:*:*:*:*:*:*:*:*
cpe:2.3:a:br-automation:scene_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*
Vendors & Products Br-automation
Br-automation automation Runtime
Br-automation mapp Cockpit
Br-automation mapp View
Br-automation mapp Vision
Br-automation scene Viewer
Br-automation vc4
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Apr 2025 07:00:00 +0000

Type Values Removed Values Added
Description An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4 could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path.This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2. An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.
cve-icon MITRE

Status: PUBLISHED

Assigner: ABB

Published:

Updated: 2025-04-24T06:52:46.092Z

Reserved: 2024-03-19T08:15:24.368Z

Link: CVE-2024-2637

cve-icon Vulnrichment

Updated: 2024-08-01T19:18:48.124Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-05-14T19:15:10.230

Modified: 2025-04-24T07:15:29.910

Link: CVE-2024-2637

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses