CVE-2024-2637— Insecure Loading of Code in B&R Products
Quick assessment
Affected
B&R Industrial Automation Scene Viewer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
B&R Industrial Automation Scene Viewer是奥地利贝加莱工业自动化（B&R Industrial Automation）公司的一种可视化工具，主要用于工业自动化系统中的可视化和仿真场景。 部分B&R产品存在代码问题漏洞。攻击者利用该漏洞可以远程执行代码。以下产品及版本受到影响：Scene Viewer 4.4.0之前版本、Automation Runtime J4.93之前版本、mapp Vision 5.26.1之前版本、mapp View 5.24.2之前版本、map
Possible ATT&CK Techniques 3 AI
T1055 · Process Injection T1059 · Command and Scripting Interpreter T1218 · System Binary Proxy Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-2637
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insecure Loading of Code in B&R Products
Source: CVE Program / CVE List V5
Vulnerability Description
An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对搜索路径元素未加控制
Source: CVE Program / CVE List V5
Vulnerability Title
B&R Industrial Automation Scene Viewer 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
B&R Industrial Automation Scene Viewer是奥地利贝加莱工业自动化（B&R Industrial Automation）公司的一种可视化工具，主要用于工业自动化系统中的可视化和仿真场景。 部分B&R产品存在代码问题漏洞。攻击者利用该漏洞可以远程执行代码。以下产品及版本受到影响：Scene Viewer 4.4.0之前版本、Automation Runtime J4.93之前版本、mapp Vision 5.26.1之前版本、mapp View 5.24.2之前版本、map
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-2637
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-2637
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: B&R Industrial Automation
-
CVE-2025-3450
Automation Runtime SDM requests may impact system -
CVE-2024-45482
Privilege escalation in B&R APROL -
CVE-2024-45481
Improper authentication in SSH of B&R APROL -
CVE-2024-45480
Unauthorized local file reading in B&R APROL -
CVE-2024-8315
Improper Handling of Insufficient Permissions or Privileges
Same weakness: CWE-427
-
CVE-2026-47570
NVIDIA Windows驱动CUDA库加载路径漏洞 -
CVE-2026-89325
Rapid7 Insight Agent: Uncontrolled search path element in In -
CVE-2026-6935
Multiple Vulnerabilities in IBM Concert Software -
CVE-2026-91803
Security Vulnerability Report – Foxit PDF Editor/Reader Upda -
CVE-2026-25264
Uncontrolled Search Path Element in Qualcomm Software Center
V. Comments for CVE-2024-2637
No comments yet