Horizon Alert
Summary of the vulnerability and why it matters
An Improper Resource Locking vulnerability exists in the SDM component of B&R Automation Runtime, potentially allowing an unauthenticated attacker to delete data and cause denial of service. This type of issue can disrupt critical operations by rendering systems unavailable.
- Attackers can delete data causing service denial.
- It impacts industrial automation systems.
- Confirm relevance and exposure to operational technology.
Attack Path
How an attacker could exploit the issue
An attacker could reach the vulnerable component over the network without needing any prior access or authentication. By interacting with the SDM component, they could trigger a vulnerability that allows them to delete data, potentially leading to a denial of service.
- Unauthenticated network access required.
- Triggered by interacting with the SDM component.
- Risk of data deletion and denial of service.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to delete data within the SDM component, leading to denial of service.
- Data deletion in SDM.
- Unauthenticated network access.
- Service disruption.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects the SDM component of B&R Automation Runtime, impacting data integrity and availability. Given its critical nature and potential for unauthenticated network exploitation, immediate identification of affected systems is paramount. Infrastructure and operational technology teams are likely responsible for managing this component. The first practical step is to locate all instances of the affected technology, confirm their reachability and business criticality, and then engage the accountable owner to prioritize and plan remediation.
- Infrastructure and OT teams should own remediation.
- Verify system reachability and business criticality.
- Plan remediation based on identified risk.
