What’s Vulnerable › Vulnerabilities

CVE-2022-4286: Reflected Cross-Site Scripting Vulnerabilities in Automation Runtime

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-14 · updated 2026-06-17
• Weakness: CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session.

Affected products

• B&R Industrial Automation Automation Runtime: from 3.00 through c4.93

References

• https://www.br-automation.com/downloads_br_productcatalogue/assets/1675607299099-en-original-1.0.pdf
• https://www.br-automation.com/downloads_br_productcatalogue/assets/1675607299099-en-original-1.0.pdf

Get alerted when CVE-2022-4286 or the next vulnerability affects your stack