Paper/Archive/CVE-2025-11043

CVE-2025-11043

B&R Industrial Automation GmbH B&R Automation Studio — Improper Server Certificate Validation in Automation Studio

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 14.5.145 × 202.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges.

Affected

ProductAffectedFixed inSource

B&R Automation Studio4–CNA

B&R Automation Studio6 – < 6.56.5CNA

Scores by source

ABB (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

ABB (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refbr-automation.com/fileadmin/SA25P004-4f45197f.pdf