Read the docs

B&R Industrial Automation

Records69All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical15CVSS 9.0–10.0
CVSS high34CVSS 7.0–8.9

Exploited now

B&R Industrial Automation records in CISA KEV

No B&R Industrial Automation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Industrial Automation Aprol 16 records MEDIUM Automation Studio 10 records MEDIUM Automation Runtime 8 records MEDIUM Gatemanager 4260 Firmware 4 records LOW Gatemanager 8250 Firmware 4 records LOW Gatemanager 9250 Firmware 4 records LOW Sitemanager 2 records LOW Automation Net/pvi 1 record LOW

Records

16 records in Industrial Automation Aprol · all components

TI-2022-21498 CVE-2022-43764 · GHSA-pmw8-p4g8-wr53

Buffer overflow when changing configuration on Tbase Server

Priority MEDIUM 50

Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00776 Published 2023-02-08 No fix listed CWE-121
TI-2022-21496 CVE-2022-43762 · GHSA-56vg-qgwv-6h64

Memory leak when receiving messages in APROL Tbase server

Priority MEDIUM 49

Lack of verification in B&R APROL Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00619 Published 2023-02-08 No fix listed CWE-119
TI-2022-21495 CVE-2022-43761 · GHSA-p9q7-pf62-483h

Lack of authentication when managing APROL database

Priority MEDIUM 49

Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system configuration.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00551 Published 2023-02-08 No fix listed CWE-306
TI-2022-21499 CVE-2022-43765 · GHSA-9fr2-r98v-qc2f

DoS in APROLs Tbase server

Priority MEDIUM 40

B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00616 Published 2023-02-08 No fix listed CWE-252
TI-2022-21497 CVE-2022-43763 · GHSA-x3q4-892x-xrc9

Lack of checking preconditions in APROL

Priority MEDIUM 40

Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00616 Published 2023-02-08 No fix listed CWE-252
TI-2024-05219 CVE-2024-5622 · GHSA-364p-86w3-x6rv

Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL

Priority LOW 33

An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00168 Published 2024-08-29 No fix listed CWE-250
TI-2024-05220 CVE-2024-5623 · GHSA-mvj8-h6fp-pcrp

Untrusted search path vulnerability in B&R APROL

Priority LOW 26

An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00168 Published 2024-08-29 No fix listed CWE-250
TI-2024-05221 CVE-2024-5624 · GHSA-8423-fqh5-4pfr

Cross-site scripting in B&R APROL

Priority LOW 23

Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL <= R 4.4-00P3 may allow a network-based attacker to execute arbitrary JavaScript code in the context of the user's browser session

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00253 Published 2024-08-29 No fix listed CWE-79
Open these records in search →