CVE-2024-8603 Overview
CVE-2024-8603 is a cryptographic vulnerability in the SSL/TLS component of B&R Automation Runtime and B&R mapp View. The flaw stems from the use of a broken or risky cryptographic algorithm [CWE-327]. Unauthenticated network-based attackers can abuse the weakness to masquerade as legitimate services on affected industrial automation devices. The vulnerability affects B&R Automation Runtime versions before 6.1 and B&R mapp View versions before 6.1.
Critical Impact
An unauthenticated remote attacker can impersonate trusted services on industrial control systems, enabling service spoofing and downstream integrity attacks against operators and connected devices.
Affected Products
- B&R Automation Runtime versions before 6.1
- B&R mapp View versions before 6.1
- Industrial control deployments relying on the affected SSL/TLS component
Discovery Timeline
- 2025-01-15 - CVE-2024-8603 published to the National Vulnerability Database (NVD)
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-8603
Vulnerability Analysis
The vulnerability resides in the SSL/TLS implementation shipped with B&R Automation Runtime and B&R mapp View. The component uses a cryptographic algorithm classified as broken or risky under [CWE-327]. Because TLS underpins service authentication on these devices, a weakness in the cryptographic primitives degrades the trust guarantees of the protocol.
An attacker with network reach to an affected device can leverage the weak algorithm to impersonate a legitimate service. The integrity impact is high, while confidentiality and availability impacts are not asserted by the vendor scoring. Successful exploitation undermines authentication assurances between engineering workstations, HMIs, and runtime controllers.
Root Cause
The root cause is the selection or acceptance of a cryptographic algorithm that no longer provides adequate security guarantees within the SSL/TLS stack. Algorithms in this category include deprecated hash functions, weak signature schemes, or obsolete cipher suites that allow forgery or impersonation. Refer to the B&R Automation Security Advisory for the precise algorithm and component details.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction, though successful exploitation depends on specific conditions described by the attack requirements metric. An attacker positioned on a network path reachable by the target device can present a forged certificate or service identity that the affected SSL/TLS component accepts as legitimate. This enables masquerading as a controller, runtime, or mapp View endpoint.
No verified public exploit code is available for CVE-2024-8603. See the vendor advisory for technical specifics.
Detection Methods for CVE-2024-8603
Indicators of Compromise
- Unexpected TLS handshakes negotiating deprecated cipher suites or signature algorithms against B&R devices
- Presentation of unfamiliar or self-signed certificates by hosts impersonating B&R Automation Runtime or mapp View services
- Anomalous source addresses initiating TLS sessions to industrial control endpoints on operator networks
Detection Strategies
- Inventory all B&R Automation Runtime and mapp View instances and identify versions earlier than 6.1
- Capture and inspect TLS handshakes on operational technology (OT) segments to flag weak algorithms in use
- Correlate certificate fingerprints presented by B&R services over time to detect substitution
Monitoring Recommendations
- Forward OT network telemetry and TLS metadata to a centralized analytics platform for baseline deviation analysis
- Alert on TLS sessions to or from B&R devices that negotiate algorithms outside an approved allowlist
- Monitor for new or unexpected listeners on ports historically used by B&R Automation Runtime services
How to Mitigate CVE-2024-8603
Immediate Actions Required
- Upgrade B&R Automation Runtime to version 6.1 or later
- Upgrade B&R mapp View to version 6.1 or later
- Restrict network access to engineering and runtime services using firewall rules and network segmentation
- Review and pin certificates used by B&R services where the deployment supports it
Patch Information
B&R has addressed the vulnerability in Automation Runtime 6.1 and mapp View 6.1. Patch details, fixed versions, and downstream product guidance are published in the B&R Automation Security Advisory. Operators should plan upgrades during maintenance windows consistent with site change-control procedures.
Workarounds
- Isolate affected devices on dedicated OT VLANs with strict ingress and egress filtering
- Place TLS-terminating jump hosts or industrial firewalls in front of vulnerable services to enforce modern cipher suites
- Disable or block remote access paths to B&R services from untrusted networks until upgrades are completed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
