B&R PVI Client Insertion of Sensitive Information into Log File Vulnerability

A vulnerability allowing the insertion of sensitive information into log files has been identified in B&R PVI client versions prior to 6.5. This issue can be exploited by an authenticated local attacker to retrieve credential information processed by the PVI client application. Although the logging function is disabled by default, it can be manually activated by the user.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, such as credentials, stored in the PVI client application's log files.

Remediation

Users are advised to update to B&R PVI client version 6.5.0 or later. PVI is included in the Automation Studio installation package and shares the same version number as the corresponding Automation Studio release.