CVE-2025-11043

Improper Server Certificate Validation in Automation Studio

State: Published
Severity: 9.1 Critical
Published: Jan 19, 2026
Updated: Jan 20, 2026
Reserved: Sep 26, 2025

Description

An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges.

Scores

CVSS	Score	Vector	Source
4.0	9.1 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	ABB
3.1	7.4 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	ABB

Weaknesses

CWE-295 Improper Certificate Validation

Affected Products

Product	Versions
B&R Automation StudioB&R Industrial Automation GmbH	4Affected 6 to before 6.5Affected

References

https://www.br-automation.com/fileadmin/SA25P004-4f45197f.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.