Main Vulnerability Database Vulnerabilities #VU26605

Missing Required Cryptographic Step in Automation Studio - CVE-2019-19101

Published: April 6, 2020

Vulnerability identifier: #VU26605

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19101

CWE-ID: CWE-325

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a man-in-the-middle (MitM) attack.

The vulnerability exists due to the missing secure communication definition and an incomplete TLS validation in the upgrade service. A remote attacker can perform MitM attacks via the B&R upgrade server.

This vulnerability affects the following versions:

Automation Studio, Versions 4.0.x

Automation Studio, Versions 4.1.x

Automation Studio, Versions 4.2.x

Automation Studio, versions prior to 4.3.11SP

Automation Studio, versions prior to 4.4.9SP

Automation Studio, versions prior to 4.5.4SP

Automation Studio, versions prior to 4.6.3SP

Automation Studio, versions prior to 4.7.2

Automation Studio, versions prior to 4.8.1

Affected software

Automation Studio

How to mitigate CVE-2019-19101

Install updates from vendor's website.

Automation Studio - addressed in versions 4.3.11SP, 4.4.9SP, 4.5.4SP, 4.6.3SP, 4.7.2, 4.8.1

External References

Related Security Bulletins