B&r Industrial Automation B&r Aprol
12 CVEs affecting B&r Industrial Automation B&r Aprol. Latest disclosed: 2025-03-25. Critical: 2, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43764 | Critical | 9.8 | 2023-02-08 | Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow. This… |
CVE-2022-43761 | Critical | 9.4 | 2023-02-08 | Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system configuration. … |
CVE-2024-5623 | High | 7.8 | 2024-08-29 | An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code u… |
CVE-2024-5622 | High | 7.8 | 2024-08-29 | An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker… |
CVE-2022-43765 | High | 7.5 | 2023-02-08 | B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to c… |
CVE-2022-43763 | High | 7.5 | 2023-02-08 | Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07. … |
CVE-2022-43762 | High | 7.5 | 2023-02-08 | Lack of verification in B&R APROL Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages |
CVE-2024-5624 | Medium | 6.1 | 2024-08-29 | Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL <= R 4.4-00P3 may allow a network-based attacker to execute arbitrary JavaScript… |
CVE-2024-8315 | | 2025-03-25 | An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker t… | |
CVE-2024-45482 | | 2025-03-25 | An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker fr… | |
CVE-2024-45481 | | 2025-03-25 | An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to a… | |
CVE-2024-45480 | | 2025-03-25 | An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticat… |