OTPulse

B&R Automation Runtime

Plan PatchCVSS 7.5ICS-CERT ICSA-25-028-01Jan 15, 2025
B&R Automation
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A weakness in self-signed certificate generation in B&R Automation Runtime and mapp View allows an attacker to masquerade as legitimate services on affected devices. The vulnerability exists in versions prior to 6.1 and has been corrected in version 6.1 and later. Exploitation does not require authentication or user interaction and requires only network access to the affected device.

What this means
What could happen
An attacker could impersonate legitimate services on your Automation Runtime or mapp View system by generating fraudulent self-signed certificates, allowing them to intercept communications or gain unauthorized access to control operations.
Who's at risk
Manufacturing facilities, process control plants, and automation integrators using B&R Automation Runtime or mapp View for industrial automation, process control, and machine control—particularly those relying on self-signed certificates for secure service communication.
How it could be exploited
An attacker with network access to an affected device could exploit weak certificate generation logic in the self-signed certificate creation process. By leveraging this weakness, they could create certificates that appear legitimate and use them to masquerade as trusted services, potentially intercepting or redirecting control system traffic.
Prerequisites
  • Network access to the affected B&R device
  • The device must be generating self-signed certificates (typical in production deployments)
  • No authentication required to exploit the certificate generation weakness
Remotely exploitableNo authentication requiredLow complexity attackAffects certificate-based trust mechanismsCould enable service impersonation
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Automation Runtime < 6.1<6.16.1
mapp View < 6.1<6.16.1
Remediation & Mitigation
0/4
Do now
0/1
WORKAROUNDRestrict network access to management and certificate generation services on B&R devices to authorized engineering workstations and control networks only
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate B&R Automation Runtime to version 6.1 or later
HOTFIXUpdate B&R mapp View to version 6.1 or later
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate B&R Automation Runtime and mapp View systems from untrusted networks
View full CISA ICS-CERT advisory
API: /api/v1/advisories/a8262188-0789-44ea-8644-eb16d1b78545

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.