CVE-2024-0220 is a high severity (CVSS 8.3) flaw in B&R Automation Studio Upgrade Service and B&R Technology Guarding, which use insufficient cryptography to talk to upgrade and licensing servers. A network attacker could run code or read sensitive data. Check the B&R advisory for fixed versions.
What's affected
The record names two products: B&R Automation Studio (its Upgrade Service) and B&R Technology Guarding. The record's configuration data does not give version ranges, only the product names.
We tried to fetch the B&R advisory PDF (its file name refers to the Automation Studio Upgrade Service using insufficient encryption) but the request timed out, so we have no confirmed affected or fixed versions. Do not assume any version is safe or unsafe until you have read the advisory. The vendor's document is the source of truth for this one.
How to check if you're exposed
Start with an inventory of engineering workstations running B&R Automation Studio, and any system running Technology Guarding. These are often on engineering laptops and in OT adjacent networks, and they are not always in the standard IT software inventory.
For each system, record the product version. In Automation Studio the version is shown under the Help menu, and Windows Apps and features lists the installed products. Compare each version with the ranges in the B&R advisory.
Then look at network exposure. The risk comes from how these tools reach upgrade and licensing servers, so ask which networks those systems use to get out. A workstation that fetches upgrades across an untrusted network carries more risk than one on a controlled path. If you cannot answer that quickly, that is a finding in itself.
What to do now
- Inventory Automation Studio and Technology Guarding installs, including engineering laptops.
- Obtain the B&R advisory and note the fixed versions for each product.
- Apply the vendor's updates, and follow any steps B&R gives for the upgrade and licensing services.
- Until updated, avoid running upgrade or licensing checks over untrusted networks.
- Review how engineering workstations reach the internet and restrict it to what is needed.
Why it matters
The record lists three weaknesses: CWE-94 (code injection), CWE-319 (cleartext transmission of sensitive information) and CWE-1240 (use of a cryptographic primitive with a risky implementation). Put together, the description says the products use weak protection for traffic to upgrade and licensing servers. A network based attacker positioned between the product and the server could run arbitrary code on the product or read sensitive data in transit.
Upgrade channels are a high value target in any software. If an attacker can tamper with what the client receives, they can supply their own content, and the client has to trust the channel to know the difference. That makes cryptographic quality on these channels critical, not optional.
The CVSS vector has high attack complexity, because a network position is needed, and requires user interaction. The record's KEV flag is false and we found no statement of exploitation. Engineering workstations in industrial settings deserve priority anyway, because they often hold project files and credentials for production equipment.
Quick check
Which versions of B&R Automation Studio are fixed?
We could not confirm that. The B&R advisory should be checked for the fixed versions of each product.
What kind of attacker is needed?
A network based attacker who can intercept or alter traffic between the product and the upgrade or licensing servers, per the record.
Sources
Last reviewed: 19 October 2026.
