CVE-2022-43764 Buffer overflow when changing configuration on Tbase Server
A buffer overflow in B&R APROL Tbase Server allows attackers to execute arbitrary code or cause denial of service via malicious configuration inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-43764?
CVE-2022-43764 is a critical memory corruption vulnerability in B&R APROL, published on 8 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow. This may lead to Denial-of-Service conditions or execution of arbitrary code.
Which versions are affected by CVE-2022-43764?
It affects 1 product.
Products include Br-Automation Industrial Automation Aprol.
How do I fix CVE-2022-43764?
No fix has been published for CVE-2022-43764 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-43764 being exploited?
There is no known exploitation of CVE-2022-43764 in the wild and no public exploit code.
Other vulnerabilities in B&R APROL
Sources
Also known as GHSA-pmw8-p4g8-wr53.