B&R Automation Runtime and mapp View SSL/TLS Vulnerability Allowing Service Masquerading

A vulnerability has been identified in the SSL/TLS component of B&R Automation Runtime and B&R mapp View, both in versions prior to 6.1. This vulnerability involves the use of a broken or risky cryptographic algorithm, which can be exploited by unauthenticated, network-based attackers to impersonate services on affected devices. The flaw arises because these applications generate self-signed certificates during the boot process, using an algorithm that is no longer considered secure. This mechanism is intended for testing purposes only, not for production environments.

Impact

Exploitation of this vulnerability allows attackers to masquerade as services on impacted devices.

Remediation

Users are advised to update to B&R Automation Runtime version 6.1 or B&R mapp View version 6.1. Instructions for installing updates and identifying the current product version are available in the user manual.