CVE-2024-0323 is a critical severity (CVSS 9.8) weak ftp encryption weakness in B&R Automation Runtime. B&R advisory SA23P004 says the fix is in Automation Runtime I4.93. It is not listed as exploited in the wild by CISA. Check your own installs against the affected range below.
What's affected
B&R Automation Runtime versions earlier than I4.93. The FTP server in the runtime still accepts SSLv3, TLSv1.0 and TLSv1.1.
The weakness is mapped to CWE-1240, use of a cryptographic primitive with a risky implementation. The record was published on 2024-02-05. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
B&R lists a CVSS 3.1 base score of 9.8 and a temporal score of 9.1, both Critical, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C. The record shows the 9.8 base score. Both figures say the same thing in practice, and the temporal score only reflects the exploit and remediation state at publication.
How to check if you're exposed
In Automation Studio or on the controller, find the Automation Runtime version in use and compare it to I4.93. The B&R advisory says the step to identify the installed product version is described in the user manual. You can also test whether the FTP server is reachable from your management network, and whether you use it at all.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of B&R Automation Runtime in your environment, including test systems and anything bought or installed by a team outside IT.
- Update B&R Automation Runtime to I4.93 or later, following the process in the user manual.
- Disable the FTP service on the controller if you do not use it.
- Keep controller networks segmented and away from the internet.
- Prefer transfer methods that you can confirm use a current TLS version.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
SSLv3, TLSv1.0 and TLSv1.1 are obsolete protocol versions with known weaknesses. A service that still accepts them lets a network attacker push a connection down to a weak version, which can allow interception or decryption of traffic.
Industrial controllers are often deployed for many years, which is why legacy protocol support survives in them. The vendor fix removes the obsolete versions from the FTP server.
The CVSS vector reads as follows. The attack is possible over the network, attack complexity is low, privileges required are none, and user interaction is not needed. The impact on confidentiality, integrity and availability is high, high and high respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. Check the vendor advisory for current status.
Which versions are fixed?
B&R advisory SA23P004 says the fix is in Automation Runtime I4.93.
Sources
Last reviewed: 19 October 2026.
