Cyber Security

Contact B&R Cyber Security Team

Do you have a question regarding Cyber Security in B&R products?
Do you want to report a vulnerability or security issue in a B&R product?
Please send an encrypted email to cybersecurity@br-automation.com using our PGP key.

Cyber Security Guidelines

The General recommendations for safeguarding control systems contain generic notes regarding protection of industrial control systems and control networks.

Cyber Security Advisories and Notices

2022

Number	Description	Version
01/2022	Advisory: RCE through Project Upload from Target	1.0

2021

Number	Description	Version
15/2021	Notice: Log4Shell Impact on B&R Products	1.0
14/2021	Advisory: Vulnerabilities in B&R Automation Studio and PVI Windows Services	1.0
13/2021	Advisory: Number:Jack in B&R Products	1.0
12/2021	Advisory: RCE Vulnerability in Automation Studio	1.0
11/2021	Advisory: ZipSlip Vulnerability in Automation Studio Project Import	1.0
10/2021	Advisory: DLL Hijacking Vulnerability in Automation Studio	1.0
09/2021	Notice: INFRA:HALT - Impact on B&R Products	1.0
08/2021	Advisory: Denial of service vulnerability on Automation Runtime webserver	1.0
07/2021	Advisory: Denial of Service vulnerability in B&R Industrial Automation PROFINET IO Device	1.0
06/2021	Advisory: Stack crash in B&R Industrial Automation X20 EthernetIP Adpater	1.0
05/2021	Advisory: Multiple Vulnerabilities in AR NTP Service	1.0
04/2021	Advisory: Amnesia33- Impact on B&R Products	1.1
03/2021	Advisory: NAME:WRECK Impact on Automation Runtime and ARwin	1.1
02/2021	Advisory: Denial-of-Service Vulnerability handling PROFINET DCE-RPC Network Packets	1.0
01/2021	Advisory: B&R Products affected by WIBU CodeMeter Vulnerabilities	1.1

2020

Number	Description	Version
01/2020	Advisory: Automation Runtime SNMP Authentication and Authorization Weakness	1.0
02/2020	Advisory: TPM-Fail	1.1
03/2020	Advisory: Multiple Vulnerabilities in Automation Studio	1.1
04/2020	Advisory: Automation Runtime TFTP Service DoS Vulnerability	1.1
05/2020	Notice: Ripple20 – Impact on B&R Products	1.0
06/2020	Advisory: Multiple Vulnerabilities in SiteManager and GateManager	1.0
07/2020	Advisory: Multiple Vulnerabilities in GateManager	1.0

2019

Number	Description	Version
2019_02	VxWorks RPC Buffer Overflow Vulnerability CVE-2019-9865	1.0
2019_01	VxWorks IPnet Vulnerabilities	1.1

Code Signing Certificates

B&R Industrial Automation signs provided software deliverables. This ensures that only products that have been approved in accordance with our high quality and security standards are marked with our name. The code signing certificates listed below for products released by B&R enable our customers to verify the integrity and authenticity of software deliverables.

Valid from	Valid to	Fingerprint	Keyfile
01.07.2015	05.08.2016	2a2839fe1affb03e619e0e3f33e91ebc4fef3b62	Download file
26.07.2016	27.07.2018	b4d11977baae8827c8ff1d466969fd5f1b91bfe7	Download file
23.05.2018	23.05.2020	748aa0d710e6877921d2b67ceda9f7c4cafaf9ed	Download file
16.10.2018	23.05.2020	934b742c32b34e856370cc0f62251b3c64cc666e	Download file
29.04.2020	23.06.2022	d095488a2b2efb0440714f6b5baaa5e60e0c5604	Download file
15.04.2021	23.06.2022	13dd07b5d864ad8723fc3549e5eb0c01331e5734	Download file
15.06.2021	15.06.2022	58176987f97e357d0643013ca3900b74ecbb7630	Download file
22.10.2021	23.10.2021	48030051866e5e41022e123de6f00345cc5b83bb	Download file