CVE-2024-10209 B&R Industrial Automation GmbH CVE debrief

Who should care

OT/ICS administrators, B&R APROL engineers, plant operations teams, and security responders who manage systems where multiple authenticated users share the same APROL environment. Environments with local user access, shared engineering stations, or runtime hosts should prioritize review.

Technical summary

The advisory describes an Incorrect Permission Assignment for Critical Resource in the file system used by B&R APROL <4.4-01. The issue can let an authenticated local attacker access and modify another user’s configuration, creating confidentiality, integrity, and availability impact. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting local attack conditions with low privileges and no user interaction.

Defensive priority

High. The vulnerability affects a core OT product and can expose or alter user configuration on affected hosts. Because the issue is local and requires authentication, priority should be highest on shared or multi-user engineering/runtime systems and any environment where local accounts are not tightly controlled.

Recommended defensive actions

• Apply the vendor patch or upgrade to a non-vulnerable version of B&R APROL at the earliest convenient maintenance window.
• Verify the installed APROL version against the vendor documentation before and after remediation.
• If credentials or secrets may have been exposed, change all relevant passwords/secrets after applying the update, as recommended by the vendor.
• Review local account access and reduce unnecessary authenticated local access on affected systems.
• Follow CISA and vendor ICS defense-in-depth guidance for segmentation, least privilege, and secure administration of OT assets.

Evidence notes

This debrief is based only on the supplied CISA CSAF advisory (ICSA-25-093-05) and the vendor/CISA references listed in the corpus. The advisory dates supplied are 2025-03-24 for publication and modification. The affected product is identified as B&R APROL <4.4-01, and the remediation guidance in the corpus explicitly recommends patching/upgrading and changing secrets/passwords after update where confidentiality may be impacted.

Official resources