CVE-2024-45483 B&R Industrial Automation GmbH CVE debrief

Who should care

Operators and maintainers of B&R APROL deployments, especially industrial or OT environments where devices may be physically accessible to contractors, visitors, or field personnel. Security and operations teams responsible for local console access, boot settings, and system recovery procedures should pay attention.

Technical summary

The vulnerability is described as a Missing Authentication for Critical Function in the GRUB configuration used by B&R APROL <4.4-01. The attack requires physical access and no authentication, and the CVSS vector reflects high potential impact to confidentiality, integrity, and availability if the system boot configuration is modified. The provided advisory links the issue to the operating system boot process rather than remote network access, so exposure is primarily local/physical. B&R’s remediation guidance is to patch or upgrade to a non-vulnerable version and then change secrets/passwords after updating, because some addressed issues may affect credential confidentiality.

Defensive priority

Medium priority for most environments, but higher priority for systems with weak physical security or exposed local access paths.

Recommended defensive actions

• Identify all B&R APROL systems running versions earlier than 4.4-01.
• Apply the vendor patch or upgrade to a non-vulnerable version as soon as operationally feasible.
• Review and restrict physical access to affected systems, including consoles, cabinets, and maintenance interfaces.
• Verify boot configuration protection and recovery controls as part of local hardening and change-management procedures.
• After updating, change all secrets and passwords as recommended by B&R.
• Document the installed product version and update process using the vendor user manual referenced in the advisory.

Evidence notes

The source corpus states that a Missing Authentication for Critical Function in the GRUB configuration used by B&R APROL <4.4-01 may allow an unauthenticated physical attacker to alter the operating system boot configuration. The advisory metadata identifies B&R APROL as the affected product and lists the remediation as patching or upgrading to a non-vulnerable version. The CVE and source advisory were both published on 2025-03-24 in the provided timeline.

Official resources