U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database

Vulnerability Change Records for CVE-2024-2637

Change History

New CVE Received from Asea Brown Boveri Ltd. (ABB) 5/14/2024 3:15:10 PM

Action Type Old Value New Value
Added Description 

								
							
							
								
							
						
								
							
								
An authenticated local attacker who successfully exploited this vulnerability could insert and run arbitrary code using legitimate B&R software's.

An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial  Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4 could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path.
This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2.



								
								
					

					

						Added
						CVSS V3.1
						
							
							
								
							
								

								
							
							
								
							
						
								
							
								
Asea Brown Boveri Ltd. (ABB) AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

								
								
					

					

						Added
						CWE
						
							
							
								
							
								

								
							
							
								
							
						
								
							
								
Asea Brown Boveri Ltd. (ABB) CWE-427

								
								
					

					

						Added
						Reference
						
							
							
								
							
								

								
							
							
								
							
						
								
							
								
Asea Brown Boveri Ltd. (ABB) https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf [No types assigned]