CVE-2020-24681
📋 TL;DR
This vulnerability allows local attackers to escalate privileges on systems running affected versions of B&R Industrial Automation Automation Studio. By exploiting incorrect permission assignments for critical resources, attackers can gain elevated system privileges. This affects users of Automation Studio versions 4.6.0 through 4.6.X, 4.7.0 before 4.7.7 SP, 4.8.0 before 4.8.6 SP, and 4.9.0 before 4.9.4 SP.
💻 Affected Systems
- B&R Industrial Automation Automation Studio
📦 What is this software?
Automation Studio by Br Automation
Automation Studio by Br Automation
Automation Studio by Br Automation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative privileges, allowing installation of persistent malware, data theft, and disruption of industrial control operations.
Likely Case
Local privilege escalation enabling attackers to bypass security controls, access sensitive industrial automation data, and modify system configurations.
If Mitigated
Limited impact with proper network segmentation, least privilege principles, and monitoring in place, though local access could still lead to privilege escalation.
🎯 Exploit Status
Requires local access to the system. The CWE-732 (Incorrect Permission Assignment) suggests straightforward exploitation once local access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.7.7 SP, 4.8.6 SP, 4.9.4 SP, and later versions
Vendor Advisory: https://www.br-automation.com/fileadmin/2021-14-BR-AS-NET-PVI-Service-Issues-c3710fbf.pdf
Restart Required: Yes
Instructions:
1. Download the latest service pack from B&R Industrial Automation website. 2. Backup current projects and configurations. 3. Install the service pack following vendor instructions. 4. Restart the system. 5. Verify installation and test functionality.
🔧 Temporary Workarounds
Restrict Local Access
allLimit physical and remote access to systems running Automation Studio to authorized personnel only.
Apply Least Privilege
windowsRun Automation Studio with minimal necessary privileges and implement user account control restrictions.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Automation Studio systems from other critical networks.
- Enhance monitoring and logging on affected systems to detect privilege escalation attempts.
🔍 How to Verify
Check if Vulnerable:
Check Automation Studio version via Help > About in the application interface or examine installed programs in Windows Control Panel.Check Version:
Not applicable - check via application interface or Windows Programs and FeaturesVerify Fix Applied:
Verify installed version is 4.7.7 SP or higher, 4.8.6 SP or higher, or 4.9.4 SP or higher.📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events in Windows security logs
- Unusual process creation with elevated privileges
- Changes to Automation Studio configuration files
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Windows Security Event ID 4672 (Special privileges assigned to new logon) from Automation Studio systems