Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2024-10490

Authentication bypass flaw in several mapp components

High8.4EPSS 0.49%
Published
Updated
Reserved
Assigned by
ABB

Description

An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions. B&R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.

Timeline

  1. ID reserved

    By ABB

  2. · 34 days later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-10490, by who scored it
Scored byCVSSScoreVector
ABBCNA (assigner)4.0High8.4CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Deferred4.0High8.4CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.49% · top 58% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.

Weakness

Affected products

What to do

Workaround: Enforce client device authentication in the configuration of the OPC UA server. Configure a proper “SecurityPolicy” for OPC UA Server ( Automation Help https://help.br-automation.com/#/en/4/communication/opcua/runtime/opcua_config_security.html ) and select a “CertificateStore configuration” which has “Validate SSL communication partner” set to “on” ( Automation Help https://help.br-automation.com/#/en/4/access_and_security%2Fssl%2Fssl_configuration.html ). Limit access to the OPC UA Server (default 4840/tcp) to IP addresses or IP subnets which are running instances of impacted mapp components and legitime OPC UA clients using the B&R Automation Runtime host-based firewall. Ensure only trusted personal is able to access devices with the specified IP (range) and enforce strict authentication on these devices. Please be aware that B&R Automation Runtime and its services (like mapp components) are not intended to be directly connected to the internet at any time. Customers are advised to use the host-based firewall as well as an external control network firewall to limit access to each service running at B&R Automation Runtime. Additionally, consider granting access from the outside of the control network only to specific timeframes (e.g. for maintenance). mapp View For customers only using the OPC UA Server for their mapp View Visualization, block all incoming traffic to the OPC UA Server (default port 4840/tcp) using the B&R Automation Runtime host-based firewall. Blocking external traffic on the OPC UA Server has no impact on the functionality of mapp View.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-10490 badge
[![CVE-2024-10490](https://trackcve.app/badge/CVE-2024-10490.svg)](https://trackcve.app/cve/CVE-2024-10490)

Record last updated .