{"id":"CVE-2024-0323","aliases":["EUVD-2024-16119","GHSA-4v2m-666w-ffm3"],"status":"published","title":"FTP uses unsecure encryption mechanisms","description":"The FTP server used on the B\u0026R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0023,"percentile":0.13906,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1240","CWE-327"],"published":"2024-02-05T16:05:47Z","modified":"2026-06-17T06:53:16Z","products":[{"vendor":"b\u0026r industrial automation","product":"automation runtime"},{"vendor":"b\u0026r industrial automation gmbh","product":"automation runtime"},{"vendor":"br-automation","product":"automation_runtime"}],"references":[{"url":"https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encryption_mechanisms-f57c147c.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0323"},{"url":"https://github.com/advisories/GHSA-4v2m-666w-ffm3"}],"sources":{"cve":[{"id":"CVE-2024-0323","title":"FTP uses unsecure encryption mechanisms","description":"The FTP server used on the B\u0026R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients.","status":"published","published":"2024-02-05T16:05:47.612Z","modified":"2024-09-06T07:21:29.27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1240"],"updated_at":"2026-11-02T14:34:22.525279Z"}],"euvd":[{"id":"EUVD-2024-16119","description":"The FTP server used on the B\u0026R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients.","status":"published","published":"2024-02-05T16:05:47Z","modified":"2024-09-06T07:21:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:02.201955Z"}],"ghsa":[{"id":"GHSA-4v2m-666w-ffm3","title":"Use of a Broken or Risky Cryptographic Algorithm vulnerability in B\u0026R Industrial Automation...","description":"Use of a Broken or Risky Cryptographic Algorithm vulnerability in B\u0026R Industrial Automation Automation Runtime (SDM modules).\n\n\n\nThe FTP server used on the B\u0026R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients.  \n\nThis issue affects Automation Runtime: from 14.0 before 14.93.\n\n","status":"published","published":"2024-02-05T18:31:37Z","modified":"2024-09-06T09:33:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-327","CWE-1240"],"updated_at":"2026-11-02T14:58:11.330333Z"}],"nvd":[{"id":"CVE-2024-0323","description":"The FTP server used on the B\u0026R\nAutomation Runtime supports unsecure encryption mechanisms, such as SSLv3,\nTLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct\nman-in-the-middle attacks or to decrypt communications between the affected product\nclients.","status":"published","published":"2024-02-05T16:15:54.98Z","modified":"2026-06-17T06:53:16.587Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1240"],"updated_at":"2026-11-02T14:09:34.891666Z"}]}}