CVE-2024-0220: B&R Automation Studio RCE Vulnerability

CVE-2024-0220 Overview

CVE-2024-0220 affects B&R Automation Studio Upgrade Service and B&R Technology Guarding, which use insufficient cryptography for communication with upgrade and licensing servers. A network-based attacker can exploit weak protection of these channels to execute arbitrary code on affected products or intercept sensitive data in transit. The flaw is tracked under CWE-94: Improper Control of Generation of Code and impacts industrial automation environments where these tools are deployed.

Critical Impact
Network attackers can execute arbitrary code on engineering workstations and sniff licensing or upgrade traffic, providing a foothold into operational technology environments.

Affected Products

B&R Automation Studio (Upgrade Service component)
B&R Technology Guarding
Engineering workstations communicating with B&R upgrade and licensing servers

Discovery Timeline

2024-02-22 - CVE-2024-0220 published to NVD
2025-05-06 - Last updated in NVD database

Technical Details for CVE-2024-0220

Vulnerability Analysis

The vulnerability resides in two B&R Automation components: the Automation Studio Upgrade Service and the Technology Guarding licensing client. Both communicate with remote B&R servers to retrieve software updates and validate license entitlements. The communication channels rely on insufficient cryptographic protection, which fails to prevent tampering or eavesdropping by a network-positioned adversary.

Because the upgrade channel ultimately delivers executable content to the engineering workstation, manipulation of that channel can result in arbitrary code execution. The licensing channel, in turn, can expose sensitive identifiers and tokens used to validate B&R product entitlements. The high attack complexity reflects the need to position on or manipulate the network path between the client and the legitimate B&R servers.

Root Cause

The root cause is the use of weak or improperly applied cryptography on outbound channels to upgrade and licensing infrastructure. Without strong authenticated encryption and validated server identity, the client cannot distinguish legitimate server responses from attacker-controlled ones. This deficiency aligns with CWE-94 because malicious responses can influence the code that is fetched, installed, or executed by the upgrade service.

Attack Vector

Exploitation requires the attacker to occupy a network position between the affected B&R component and the upstream server. Suitable positions include compromised routing infrastructure, malicious Wi-Fi or VPN endpoints, ARP or DNS spoofing on the engineering LAN, or upstream ISP-level interception. Once positioned, the attacker can substitute malicious upgrade payloads or capture licensing traffic. No user interaction or prior authentication is required.

No verified proof-of-concept code is publicly available for CVE-2024-0220. Refer to the B&R security advisory SA23P019 for vendor-supplied technical details.

Detection Methods for CVE-2024-0220

Indicators of Compromise

Unexpected outbound connections from engineering workstations running B&R Automation Studio to non-B&R hosts on upgrade or licensing ports.
TLS certificate anomalies, downgraded cipher suites, or plaintext payloads on sessions to B&R upgrade and licensing endpoints.
Unscheduled execution of upgrade binaries, new services, or modified files under the Automation Studio installation path.

Detection Strategies

Inspect network flows from engineering workstations and alert on connections to upgrade or licensing destinations that do not match B&R-published IP ranges or hostnames.
Monitor process creation events on Automation Studio hosts for child processes spawned by the upgrade service that are not signed by B&R.
Correlate file integrity changes in Automation Studio and Technology Guarding directories with concurrent network activity to upgrade endpoints.

Monitoring Recommendations

Enable full packet capture or netflow on OT-to-IT egress boundaries used by engineering workstations.
Forward endpoint process, network, and file telemetry from engineering hosts into a centralized analytics platform for retrospective hunts.
Baseline normal B&R upgrade and licensing traffic patterns, then alert on deviations in volume, destination, or timing.

How to Mitigate CVE-2024-0220

Immediate Actions Required

Inventory all systems running B&R Automation Studio and B&R Technology Guarding and identify which can reach external upgrade or licensing servers.
Apply the fixed versions documented in the B&R advisory SA23P019 as soon as testing permits.
Restrict engineering workstation egress so that only the documented B&R upgrade and licensing endpoints are reachable.

Patch Information

B&R has published security advisory SA23P019 covering insufficient encryption in the Automation Studio Upgrade Service and Technology Guarding. Operators should consult the vendor advisory for the list of fixed versions and apply the corresponding update on every affected engineering workstation. Until patched versions are deployed, the cryptographic weakness remains exploitable by any attacker on the network path.

Workarounds

Disable the Automation Studio Upgrade Service on hosts that do not require automatic updates and perform upgrades manually using vendor-verified installers.
Place engineering workstations behind a segmented firewall and force upgrade or licensing traffic through an inspecting proxy that enforces strong TLS to validated B&R hosts.
Use jump hosts or out-of-band networks for upgrade and licensing operations to minimize exposure of the engineering LAN to untrusted networks.

bash

# Example egress allow-list (conceptual) restricting B&R upgrade/licensing traffic
# Replace with the exact hostnames and IPs documented in advisory SA23P019
iptables -A OUTPUT -p tcp -d updates.br-automation.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -d licensing.br-automation.com --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j DROP