cve/2024/CVE-2024-0220.md

### [CVE-2024-0220](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0220)
![](https://img.shields.io/static/v1?label=Product&message=Automation%20Studio&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Technology%20Guarding&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.0.0%3C%201.4.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=4.0%3C%204.6%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-311%20Missing%20Encryption%20of%20Sensitive%20Data&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-319%20Cleartext%20Transmission%20of%20Sensitive%20Information&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-326%20Inadequate%20Encryption%20Strength&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brighgreen)

### Description

B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data.Missing Encryption of Sensitive Data, Cleartext Transmission of Sensitive Information, Improper Control of Generation of Code ('Code Injection'), Inadequate Encryption Strength vulnerability in B&R Industrial Automation B&R Automation Studio (Upgrade Service modules), B&R Industrial Automation Technology Guarding.This issue affects B&R Automation Studio: <4.6; Technology Guarding: <1.4.0.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds