Auth bypass in Br-Automation Vc4
CVE-2023-1617
Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization. This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.
Vulnerability class: Broken Authentication
EPSS: 0.007 (50.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Br-automation Vc4
- B&r Industrial Automation Vc4 — versions 3.*, 4.0*, 4.1*
Weakness classification (CWE)
References
- cybersecurity@ch.abb.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-1617?
- CVE-2023-1617 is a critical-severity vulnerability in Br-Automation Vc4, classified under Improper Authentication. CVSS score: 9.8/10. Published 2023-04-14.
- How severe is CVE-2023-1617?
- Critical severity. CVSS v3 base score is 9.8 out of 10.