CVE-2024-10207 B&R Industrial Automation GmbH CVE debrief

Who should care

OT/ICS operators running B&R APROL, APROL Web Portal administrators, and security teams responsible for patching, access control, and account hygiene in industrial environments.

Technical summary

The published advisory describes an SSRF condition in the APROL Web Portal affecting B&R APROL <4.4-00P5. The attack requires authentication and network access. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, which aligns with low confidentiality impact and no integrity or availability impact.

Defensive priority

Medium priority. Authentication is required, but the flaw still allows the server to make arbitrary requests, so exposed APROL Web Portal instances should be patched promptly and access should be limited until remediation is complete.

Recommended defensive actions

• Upgrade B&R APROL to a non-vulnerable version at the earliest convenience.
• Verify the installed product version using the vendor-documented process before and after remediation.
• Restrict access to the APROL Web Portal to trusted users and networks while patching is pending.
• After applying the update, change secrets/passwords as recommended by B&R.

Evidence notes

All statements are grounded in the supplied CISA CSAF advisory for ICSA-25-093-05 and the vendor references it cites. The advisory lists one affected product scope, B&R APROL <4.4-00P5, and one primary remediation path, patch or upgrade. The timeline fields supplied with the record place publication and modification on 2025-03-24.

Official resources