B&R Automation Runtime Weak Session Token Vulnerability in System Diagnostic Manager

A vulnerability has been identified in the System Diagnostic Manager (SDM) component of B&R Automation Runtime, specifically in versions prior to 6.4. This vulnerability arises from the generation of predictable session tokens, which could allow an unauthenticated network-based attacker to take over established user sessions. The issue is exacerbated by the lack of session-specific data processing and authentication mechanisms at the session level in the SDM.

Impact

Exploitation of this vulnerability could lead to unauthorized takeover of user sessions in the context of the SDM component.

Remediation

Users are advised to update to B&R Automation Runtime version 6.4 or later. For those using the System Diagnostic Manager, B&R recommends applying the update based on a risk assessment at the earliest convenience. The process to install updates is described in the user manual.