{"id":"CVE-2024-10490","aliases":["EUVD-2024-33499","GHSA-3r56-5r55-j5mh"],"status":"published","title":"Authentication bypass flaw in several mapp components","description":"An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B\u0026R mapp Cockpit before 6.0, B\u0026R mapp View before 6.0, B\u0026R mapp Services before 6.0, B\u0026R mapp Motion before 6.0 and B\u0026R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.\nB\u0026R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00488,"percentile":0.4234,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-288"],"published":"2024-12-02T08:46:44Z","modified":"2026-06-17T06:55:47Z","products":[{"vendor":"b\u0026r industrial automation gmbh","product":"b\u0026r mapp cockpit"},{"vendor":"b\u0026r industrial automation gmbh","product":"b\u0026r mapp motion"},{"vendor":"b\u0026r industrial automation gmbh","product":"b\u0026r mapp services"},{"vendor":"b\u0026r industrial automation gmbh","product":"b\u0026r mapp view"},{"vendor":"b\u0026r industrial automation gmbh","product":"b\u0026r mapp vision"}],"references":[{"url":"https://www.br-automation.com/fileadmin/SA22P014-90c4aa35.pdf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10490"},{"url":"https://github.com/advisories/GHSA-3r56-5r55-j5mh"}],"sources":{"cve":[{"id":"CVE-2024-10490","title":"Authentication bypass flaw in several mapp components","description":"An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B\u0026R mapp Cockpit before 6.0, B\u0026R mapp View before 6.0, B\u0026R mapp Services before 6.0, B\u0026R mapp Motion before 6.0 and B\u0026R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.\nB\u0026R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.","status":"published","published":"2024-12-02T08:46:44.044Z","modified":"2024-12-02T22:11:21.408Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-33499","description":"An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B\u0026R mapp Cockpit before 6.0, B\u0026R mapp View before 6.0, B\u0026R mapp Services before 6.0, B\u0026R mapp Motion before 6.0 and B\u0026R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.\nB\u0026R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.","status":"published","published":"2024-12-02T08:46:44Z","modified":"2024-12-02T22:11:21Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T00:04:42.699051Z"}],"ghsa":[{"id":"GHSA-3r56-5r55-j5mh","title":"An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server...","description":"An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B\u0026R mapp Cockpit before 6.0, B\u0026R mapp View before 6.0, B\u0026R mapp Services before 6.0, B\u0026R mapp Motion before 6.0 and B\u0026R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.\nB\u0026R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.","status":"published","published":"2024-12-02T09:39:12Z","modified":"2024-12-02T09:39:19Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:59:00.407025Z"}],"nvd":[{"id":"CVE-2024-10490","description":"An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B\u0026R mapp Cockpit before 6.0, B\u0026R mapp View before 6.0, B\u0026R mapp Services before 6.0, B\u0026R mapp Motion before 6.0 and B\u0026R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.\nB\u0026R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.","status":"published","published":"2024-12-02T09:15:04.613Z","modified":"2026-06-17T06:55:47.067Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:10:38.973941Z"}]}}