CVE-2023-1617: Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based…

PriorityP266critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.72%

49.2th percentile

Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The impact of this vulnerability depends on the functionality provided in the visualization. This issue affects B&R VC4: from 3.* through 3.96.7, from 4.0* through 4.06.7, from 4.1* through 4.16.3, from 4.2* through 4.26.8, from 4.3* through 4.34.6, from 4.4* through 4.45.1, from 4.5* through 4.45.3, from 4.7* through 4.72.9.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
b_r_industrial_automation	b_r_vc4	3.* – 3.96.7	—
b_r_industrial_automation	b_r_vc4	4.0* – 4.06.7	—
b_r_industrial_automation	b_r_vc4	4.1* – 4.16.3	—
b_r_industrial_automation	b_r_vc4	4.2* – 4.26.8	—
b_r_industrial_automation	b_r_vc4	4.3* – 4.34.6	—
b_r_industrial_automation	b_r_vc4	4.4* – 4.45.1	—
b_r_industrial_automation	b_r_vc4	4.5* – 4.45.3	—
b_r_industrial_automation	b_r_vc4	4.7* – 4.72.9	—
br-automation	vc4	< 3.96.8	3.96.8
br-automation	vc4	4.0.0 – 4.06.4	—
br-automation	vc4	4.10.0 – 4.16.3	—
br-automation	vc4	4.20.0 – 4.26.8	—
br-automation	vc4	>= 4.30.0 < 4.34.7	4.34.7
br-automation	vc4	4.40.0 – 4.45.1	—
br-automation	vc4	4.50.0 – 4.53.0	—
br-automation	vc4	>= 4.70.0 < 4.73.0	4.73.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.