VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
249bc4cebedade5155d8eeefbac7a00eae5d85bc
vuln-cve/data/2024/2xxx/CVE-2024-2637.json
T

571 lines
26 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2024-2637",
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"state": "PUBLISHED",
"assignerShortName": "ABB",
"dateReserved": "2024-03-19T08:15:24.368Z",
"datePublished": "2024-05-14T18:49:28.624Z",
"dateUpdated": "2025-04-24T06:52:46.092Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Scene Viewer",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Automation Runtime",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "J4.93",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mapp Vision",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "5.26.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mapp View",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "5.24.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mapp Cockpit",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "5.24.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mapp Safety",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "5.24.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VC4",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "4.73.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "APROL",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "4.4-01",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CAN Driver",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CAN Driver CC770",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CAN Driver SJA1000",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "1.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tou0ch Lock",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "B&R Single-Touch Driver",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Serial User Mode Touch Driver",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "1.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Windows Settings Changer (LTSC)",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Windows Settings Changer (2019 LTSC)",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "2.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Windows 10 Recovery Solution",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ADI driver universal",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ADI Development Kit",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "5.5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ADI .NET SDK",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "4.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SRAM driver",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "1.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HMI Service Center",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HMI Service Center Maintenance",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Windows 10 IoT Enterprise 2019 LTSC",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThanOrEqual": "1.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KCF Editor",
"vendor": "B&R Industrial Automation",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-04-02T18:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Uncontrolled Search Path Element vulnerability&nbsp;in B&amp;R Industrial Automation Scene Viewer, B&amp;R Industrial Automation Automation Runtime, B&amp;R Industrial Automation mapp Vision, B&amp;R Industrial Automation mapp View, B&amp;R Industrial Automation mapp Cockpit, B&amp;R Industrial Automation mapp Safety, B&amp;R Industrial Automation VC4, B&amp;R Industrial Automation APROL, B&amp;R Industrial Automation CAN Driver, B&amp;R Industrial Automation CAN Driver CC770, B&amp;R Industrial Automation CAN Driver SJA1000, B&amp;R Industrial Automation Tou0ch Lock, B&amp;R Industrial Automation B&amp;R Single-Touch Driver, B&amp;R Industrial Automation Serial User Mode Touch Driver, B&amp;R Industrial Automation Windows Settings Changer (LTSC), B&amp;R Industrial Automation Windows Settings Changer (2019 LTSC), B&amp;R Industrial Automation Windows 10 Recovery Solution, B&amp;R Industrial Automation ADI driver universal, B&amp;R Industrial Automation ADI Development Kit, B&amp;R Industrial Automation ADI .NET SDK, B&amp;R Industrial Automation SRAM driver, B&amp;R Industrial Automation HMI Service Center, B&amp;R Industrial Automation HMI Service Center Maintenance, B&amp;R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&amp;R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..<p>This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&amp;R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.</p>"
}
],
"value": "An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-641",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-641 DLL Side-Loading"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB",
"dateUpdated": "2025-04-24T06:52:46.092Z"
},
"references": [
{
"url": "https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insecure Loading of Code in B&R Products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
},
"adp": [
{
"affected": [
{
"vendor": "br-automation",
"product": "scene_viewer",
"cpes": [
"cpe:2.3:a:br-automation:scene_viewer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "4.4.0",
"versionType": "custom"
}
]
},
{
"vendor": "br-automation",
"product": "automation_runtime",
"cpes": [
"cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "j4.93",
"versionType": "custom"
}
]
},
{
"vendor": "br-automation",
"product": "mapp_vision",
"cpes": [
"cpe:2.3:a:br-automation:mapp_vision:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "5.26.1",
"versionType": "custom"
}
]
},
{
"vendor": "br-automation",
"product": "mapp_view",
"cpes": [
"cpe:2.3:a:br-automation:mapp_view:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "5.24.2",
"versionType": "custom"
}
]
},
{
"vendor": "br-automation",
"product": "mapp_cockpit",
"cpes": [
"cpe:2.3:a:br-automation:mapp_cockpit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "5.24.2",
"versionType": "custom"
}
]
},
{
"vendor": "br-automation",
"product": "vc4",
"cpes": [
"cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"status": "affected",
"lessThan": "4.73.2",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2024-05-14T19:33:12.195778Z",
"id": "CVE-2024-2637",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2024-06-06T14:56:12.677Z"
}
},
{
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2024-08-01T19:18:48.124Z"
},
"title": "CVE Program Container",
"references": [
{
"url": "https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf",
"tags": [
"x_transferred"
]
}
]
}
]
}
}
View Git Blame Copy Permalink