{"id":"CVE-2019-19101","aliases":["EUVD-2019-8738","GHSA-xfj2-8v99-wp6x"],"status":"published","title":"Incomplete communication encryption and validation in B\u0026R Automation Studio upgrade service","description":"A missing secure communication definition and an incomplete TLS validation in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.5SP, \u003c 4.6.4 and \u003c 4.7.2 enable unauthenticated users to perform MITM attacks via the B\u0026R upgrade server.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00528,"percentile":0.44986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295","CWE-326"],"published":"2020-04-29T02:07:32Z","modified":"2026-06-17T02:26:10Z","products":[{"vendor":"b\u0026r","product":"automation studio"},{"vendor":"b\u0026r industrial automation","product":"automation studio"},{"vendor":"br-automation","product":"automation_studio"}],"references":[{"url":"https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19101"},{"url":"https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio"},{"url":"https://github.com/advisories/GHSA-xfj2-8v99-wp6x"}],"sources":{"cve":[{"id":"CVE-2019-19101","title":"Incomplete communication encryption and validation in B\u0026R Automation Studio upgrade service","description":"A missing secure communication definition and an incomplete TLS validation in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.5SP, \u003c 4.6.4 and \u003c 4.7.2 enable unauthenticated users to perform MITM attacks via the B\u0026R upgrade server.","status":"published","published":"2020-04-29T02:07:32Z","modified":"2024-08-05T02:09:39.436Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-8738","description":"A missing secure communication definition and an incomplete TLS validation in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.5SP, \u003c 4.6.4 and \u003c 4.7.2 enable unauthenticated users to perform MITM attacks via the B\u0026R upgrade server.","status":"published","published":"2020-04-29T02:07:32Z","modified":"2024-08-05T02:09:39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:26.287407Z"}],"ghsa":[{"id":"GHSA-xfj2-8v99-wp6x","title":"A missing secure communication definition and an incomplete TLS validation in the upgrade service...","description":"A missing secure communication definition and an incomplete TLS validation in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.5SP, \u003c 4.6.4 and \u003c 4.7.2 enable unauthenticated users to perform MITM attacks via the B\u0026R upgrade server.","status":"published","published":"2022-05-24T17:16:49Z","modified":"2024-04-04T02:50:28Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-295","CWE-326"],"updated_at":"2026-11-02T14:56:12.690799Z"}],"nvd":[{"id":"CVE-2019-19101","description":"A missing secure communication definition and an incomplete TLS validation in the upgrade service in B\u0026R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, \u003c 4.3.11SP, \u003c 4.4.9SP, \u003c 4.5.5SP, \u003c 4.6.4 and \u003c 4.7.2 enable unauthenticated users to perform MITM attacks via the B\u0026R upgrade server.","status":"published","published":"2020-04-29T03:15:16.58Z","modified":"2026-06-17T02:26:10.2Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-326","CWE-295"],"updated_at":"2026-11-02T14:05:46.451008Z"}]}}