CVE-2021-22275 : What You Need to Know

A Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service.

Understanding CVE-2021-22275

This CVE-2021-22275 vulnerability is related to a Denial of Service issue in the Automation Runtime webserver provided by B&R Automation.

What is CVE-2021-22275?

The vulnerability in the Automation Runtime webserver could be exploited by a remote attacker to disrupt the operation of the device and lead to a denial of service situation.

The Impact of CVE-2021-22275

With a CVSS base score of 8.6 (High), this vulnerability can result in a significant impact on the availability of the affected systems.

Technical Details of CVE-2021-22275

The following technical details outline the specific aspects of this vulnerability:

Vulnerability Description

The Buffer Overflow vulnerability allows attackers to halt the cyclic program on the device, causing a denial of service.

Affected Systems and Versions

The vulnerability affects B&R Automation Runtime webserver versions less than 4.91.

Exploitation Mechanism

The attacker can exploit this vulnerability over the network without requiring any privileges, with a low attack complexity.

Mitigation and Prevention

To address and prevent the exploitation of CVE-2021-22275, consider the following measures:

Immediate Steps to Take

Restrict access to the Automation Runtime webserver to legitimate network partners.
Implement a robust firewall setup and network segmentation.
Deactivate the Automation Runtime webserver when not in use.

Long-Term Security Practices

Continuously monitor for security updates and apply patches promptly to ensure the protection of systems.

Patching and Updates

Stay informed about security advisories from B&R Automation and apply patches and updates as soon as they are available to safeguard against potential cyber threats.