CVE-2024-8313 B&R Industrial Automation GmbH CVE debrief

Who should care

OT/ICS operators, control-system administrators, and security teams responsible for B&R APROL deployments, especially systems that expose SNMP on reachable adjacent networks or that manage sensitive configuration and credentials.

Technical summary

The advisory describes an exposure of sensitive system information and an insecure-default initialization issue in the SNMP component of B&R APROL <4.4-00P5. The attack vector is adjacent network access with no authentication required, and the supplied CVSS vector rates confidentiality, integrity, and availability impact as high (CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor remediation is to patch or upgrade to a non-vulnerable version; B&R also advises changing secrets/passwords after applying the update.

Defensive priority

High — prioritize patching or upgrading affected B&R APROL systems and reduce SNMP exposure on adjacent networks.

Recommended defensive actions

• Identify all B&R APROL instances and confirm whether they are running a version earlier than 4.4-00P5.
• Apply the vendor patch or upgrade to a non-vulnerable version as soon as operationally feasible.
• Review SNMP exposure and restrict adjacency/reachability to only trusted management networks.
• After updating, change credentials, secrets, and passwords as recommended by the vendor.
• Validate the installed product version using the vendor’s documented procedure before and after remediation.
• Follow CISA and vendor ICS defensive guidance for segmentation, least privilege, and secure configuration management.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory ICSA-25-093-05 for B&R APROL, published 2025-03-24, plus the vendor remediation note referenced in the advisory. The source metadata states the affected product as B&R APROL <4.4-00P5 and the impact as an unauthenticated adjacent attacker being able to read and alter configuration using SNMP. The remediation text explicitly recommends applying the patch or upgrading to a non-vulnerable version and changing secrets/passwords after updating.

Official resources