B&R Industrial Automation SiteManager/GateManager Multiple Vulnerabilities Advisory (CVE-2020-11641 to 11646)

Key Information Summary 1. Vulnerability Overview CVSS v3 Score: 7.7 Risk Level: Remotely exploitable, low skill level Vendor: B&R Industrial Automation GmbH Affected Devices: SiteManager and GateManager Vulnerability Types: - Path Traversal - Uncontrolled Resource Consumption - Information Exposure - Improper Authentication - Information Disclosure 2. Risk Assessment Successful exploitation of these vulnerabilities could lead to arbitrary information disclosure, manipulation, and denial-of-service conditions. 3. Technical Details 3.1 Affected Products SiteManager: All versions prior to v9.2.620236042 GateManager 4260 and 9250: All versions prior to v9.0.20262 GateManager 8250: All versions prior to v9.2.620236042 3.2 Vulnerability Overview CVE-2020-11641: Path Traversal (CVSS v3 Score: 7.7) CVE-2020-11642: Uncontrolled Resource Consumption (CVSS v3 Score: 7.7) CVE-2020-11643: Information Disclosure (CVSS v3 Score: 6.5) CVE-2020-11644: Improper Authentication (CVSS v3 Score: 6.5) CVE-2020-11645: Uncontrolled Resource Consumption (CVSS v3 Score: 6.5) CVE-2020-11646: Information Disclosure (CVSS v3 Score: 4.3) 4. Mitigation Measures Fixed Versions: - SiteManager v9.2.620236042 - GateManager 4260 and 9250 v9.0.20262 - GateManager 8250 v9.2.620236042 Recommended User Actions: - Minimize network exposure of all control system devices/systems - Place control system networks and remote devices behind firewalls, isolated from business networks - Use secure methods (e.g., VPN) when remote access is required Organizations should conduct appropriate impact analysis and risk assessment before deploying mitigation measures

Goal Reached Thanks to every supporter — we hit 100%!

B&R Industrial Automation SiteManager/GateManager Multiple Vulnerabilities Advisory (CVE-2020-11641 to 11646)