PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-10207 B&R Industrial Automation GmbH CVE debrief

CVE-2024-10207 is a medium-severity server-side request forgery issue in the APROL Web Portal for B&R APROL versions before 4.4-00P5. The advisory says an authenticated, network-based attacker can force the web server to request arbitrary URLs. CISA published the advisory on 2025-03-24, and B&R recommends patching or upgrading to a non-vulnerable version as soon as practical.

Vendor
B&R Industrial Automation GmbH
Product
B&R APROL
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-03-24
Original CVE updated
2025-03-24
Advisory published
2025-03-24
Advisory updated
2025-03-24

Who should care

OT/ICS operators running B&R APROL, APROL Web Portal administrators, and security teams responsible for patching, access control, and account hygiene in industrial environments.

Technical summary

The published advisory describes an SSRF condition in the APROL Web Portal affecting B&R APROL <4.4-00P5. The attack requires authentication and network access. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, which aligns with low confidentiality impact and no integrity or availability impact.

Defensive priority

Medium priority. Authentication is required, but the flaw still allows the server to make arbitrary requests, so exposed APROL Web Portal instances should be patched promptly and access should be limited until remediation is complete.

Recommended defensive actions

  • Upgrade B&R APROL to a non-vulnerable version at the earliest convenience.
  • Verify the installed product version using the vendor-documented process before and after remediation.
  • Restrict access to the APROL Web Portal to trusted users and networks while patching is pending.
  • After applying the update, change secrets/passwords as recommended by B&R.

Evidence notes

All statements are grounded in the supplied CISA CSAF advisory for ICSA-25-093-05 and the vendor references it cites. The advisory lists one affected product scope, B&R APROL <4.4-00P5, and one primary remediation path, patch or upgrade. The timeline fields supplied with the record place publication and modification on 2025-03-24.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-10207 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-10207

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-10207 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-10207

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-093-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.br-automation.com/fileadmin/Cyber_Security_-_Defense_in_Depth_for_BR_Products-bdd37e82.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.