Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-10490— Authentication bypass flaw in several mapp components

Quick assessment

Affected
B&R Industrial Automation GmbH B&R mapp Cockpit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

B&R Industrial Automation mapp是奥地利贝加莱工业自动化（B&R Industrial Automation）公司的一套革命性的软件工程平台，它通过集成控制工艺的专业知识到模块化软件中，简化了新应用程序的开发，从而缩短了新机器的开发周期，并显著减少了开发工作量。 B&R Industrial Automation mapp存在安全漏洞，该漏洞源于存在使用备用路径或通道绕过身份验证漏洞，未经身份验证的网络攻击者可能会利用该漏洞导致信息泄露、数据意外更改或拒绝服务。

AI Predicted 9.1 Difficulty: Easy EPSS 0.49% · P40

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-10490

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Authentication bypass flaw in several mapp components
Source: CVE Program / CVE List V5
Vulnerability Description
An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions. B&R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
B&R Industrial Automation mapp 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
B&R Industrial Automation mapp是奥地利贝加莱工业自动化（B&R Industrial Automation）公司的一套革命性的软件工程平台，它通过集成控制工艺的专业知识到模块化软件中，简化了新应用程序的开发，从而缩短了新机器的开发周期，并显著减少了开发工作量。 B&R Industrial Automation mapp存在安全漏洞，该漏洞源于存在使用备用路径或通道绕过身份验证漏洞，未经身份验证的网络攻击者可能会利用该漏洞导致信息泄露、数据意外更改或拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
B&R Industrial Automation GmbH B&R mapp Cockpit 5.0;0 ~ 6.0;0 -
B&R Industrial Automation GmbH B&R mapp View 5.0 ~ 6.0 -
B&R Industrial Automation GmbH B&R mapp Services 5.0 ~ 6.0 -
B&R Industrial Automation GmbH B&R mapp Motion 5.0 ~ 6.0 -
B&R Industrial Automation GmbH B&R mapp Vision 5.0 ~ 6.0 -

II. Public POCs for CVE-2024-10490

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-10490

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same vendor: B&R Industrial Automation GmbH
Same weakness: CWE-288

V. Comments for CVE-2024-10490

No comments yet

Leave a comment