CVE-2025-11043
Published: 19 January 2026
Summary
CVE-2025-11043 is a critical-severity Improper Certificate Validation (CWE-295) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 10.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2025-11043 is an Improper Certificate Validation vulnerability (CWE-295) in the OPC-UA client and ANSL over TLS client components of Automation Studio versions before 6.5. Published on 2026-01-19T16:15:52.873, it carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to potential impacts on confidentiality and integrity.
An unauthenticated attacker with network access could exploit this vulnerability by positioning themselves to intercept and interfere with data exchanges between the affected clients and OPC-UA or ANSL over TLS servers. Exploitation requires high attack complexity but no privileges, user interaction, or scope change, enabling the attacker to compromise the confidentiality and integrity of exchanged data.
Mitigation guidance is provided in security advisory SA25P004 from B&R Automation, available at https://www.br-automation.com/fileadmin/SA25P004-4f45197f.pdf. Systems running Automation Studio prior to version 6.5 should be upgraded to address the vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3213
Vulnerability details
An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper certificate validation (CWE-295) in OPC-UA/ANSL TLS clients directly enables MitM interception and tampering of network traffic, matching T1557 Adversary-in-the-Middle.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires proper issuance, management, and verification of PKI certificates, which would enforce correct certificate validation in the OPC-UA and ANSL over TLS clients.
Mandates cryptographic mechanisms that protect transmission confidentiality and integrity, directly addressing the failure of TLS certificate validation that enables interception and tampering.
Requires protection of session authenticity, which certificate validation failures in the affected clients directly undermine, allowing MITM interference with data exchanges.