B&R Automation Runtime Improper Resource Locking Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in B&R Automation Runtime versions prior to 6.3 and before Q4.93. This issue arises from improper resource locking in the System Diagnostics Manager (SDM) component, allowing an unauthenticated network-based attacker to send specially crafted messages that could disrupt system operations by causing the affected system node to stop.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the affected system node to stop functioning.

Remediation

Users are advised to update to B&R Automation Runtime versions 6.3 or Q4.93. For those using the System Diagnostic Manager (SDM), which is disabled by default in Automation Runtime 6, it is recommended to apply the update at the earliest convenience. The process for installing updates is described in the user manual.