CVE-2024-10490 Overview
CVE-2024-10490 is an authentication bypass vulnerability affecting multiple B&R Industrial Automation mapp product families. The flaw resides in the OPC UA Server configuration required for mapp Cockpit, mapp View, mapp Services, mapp Motion, and mapp Vision prior to version 6.0. An unauthenticated network-based attacker can use an alternate path or channel to bypass authentication controls. Successful exploitation leads to information disclosure, unauthorized modification of data, or denial of service conditions on affected industrial controllers. The weakness is tracked as [CWE-288] (Authentication Bypass Using an Alternate Path or Channel).
Critical Impact
An unauthenticated attacker with network access to the OPC UA Server can read, alter, or disrupt operational data on B&R mapp components used in industrial automation environments.
Affected Products
- B&R mapp Cockpit before 6.0
- B&R mapp View before 6.0, B&R mapp Motion before 6.0, B&R mapp Vision before 6.0
- B&R mapp Services before 6.0 (only when mpUserX or mpCodeBox are used in the Automation Studio project)
Discovery Timeline
- 2024-12-02 - CVE-2024-10490 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10490
Vulnerability Analysis
The vulnerability stems from the OPC UA Server configuration shipped with the B&R mapp framework. OPC UA (Open Platform Communications Unified Architecture) is the standard machine-to-machine communication protocol used across industrial automation. The affected configuration exposes an alternate path that allows clients to reach protected functionality without completing the expected authentication handshake.
Because OPC UA endpoints typically front PLC runtime data, attackers can read process variables, write control values, or generate request patterns that exhaust controller resources. mapp Services becomes exploitable only when the mpUserX or mpCodeBox function blocks are included in the Automation Studio project, since these components rely on the affected OPC UA configuration to enforce identity.
Root Cause
The root cause is an authentication mechanism that can be circumvented through a secondary access path, as classified by [CWE-288]. The OPC UA Server configuration does not enforce the primary authentication routine across every available channel. Requests reaching the server through the alternate path are processed as if the caller were authorized.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker reaches the OPC UA endpoint exposed by an affected mapp deployment and issues protocol requests through the unprotected path. With access established, the attacker can query node values for information disclosure, write to writable nodes to manipulate process data, or flood the service to trigger denial of service. The vendor advisory describes the conditions under which each mapp component is exposed. See the B&R Automation Security Advisory for technical details.
Detection Methods for CVE-2024-10490
Indicators of Compromise
- OPC UA session establishment on affected mapp endpoints without a preceding successful authentication exchange.
- Unexpected reads or writes to PLC nodes from network addresses outside the engineering workstation allow-list.
- Spikes in OPC UA request volume causing controller responsiveness degradation or service restarts.
Detection Strategies
- Inventory all systems running mapp Cockpit, mapp View, mapp Services, mapp Motion, or mapp Vision and confirm version 6.0 or later is installed.
- Inspect Automation Studio projects for use of mpUserX or mpCodeBox to identify exploitable mapp Services instances.
- Capture and review OPC UA traffic on TCP port 4840 for session activity that lacks a CreateSession/ActivateSession authentication sequence.
Monitoring Recommendations
- Forward OPC UA server and audit logs from B&R controllers to a centralized analytics platform for correlation.
- Alert on configuration changes to PLC tags and on writes originating from non-engineering hosts.
- Baseline normal OPC UA client populations and flag new or anonymous clients connecting to mapp endpoints.
How to Mitigate CVE-2024-10490
Immediate Actions Required
- Upgrade all affected mapp components to version 6.0 or later as specified in the vendor advisory.
- Restrict network reachability of OPC UA endpoints (TCP 4840) to authorized engineering systems using firewalls or industrial DMZ segmentation.
- Audit Automation Studio projects for mpUserX and mpCodeBox usage and prioritize remediation on those controllers.
Patch Information
B&R Industrial Automation addresses CVE-2024-10490 in mapp Cockpit, mapp View, mapp Services, mapp Motion, and mapp Vision version 6.0. Refer to the B&R Automation Security Advisory for upgrade procedures and component-specific guidance.
Workarounds
- Isolate affected controllers on dedicated VLANs and block OPC UA traffic at perimeter and cell-zone firewalls when patching is not immediately possible.
- Disable the OPC UA Server on devices where it is not operationally required.
- Enforce strict access control lists between operator workstations, engineering stations, and the controller network to limit who can reach affected endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
