PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-45480 B&R Industrial Automation CVE debrief

CVE-2024-45480 is a high-severity code injection issue in the AprolCreateReport component of B&R APROL < 4.4-00P5. According to the CISA CSAF advisory published on 2025-03-24, an unauthenticated network-based attacker may be able to read files from the local system. B&R recommends applying the patch or upgrading to a non-vulnerable version as soon as possible.

Vendor
B&R Industrial Automation
Product
B&R APROL
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2025-03-24
Original CVE updated
2025-03-24
Advisory published
2025-03-24
Advisory updated
2025-03-24

Who should care

Organizations running B&R APROL, especially operators, engineers, and administrators responsible for OT/ICS environments where APROL systems are network-reachable or support report-generation workflows.

Technical summary

The advisory describes an improper control of code generation ('Code Injection') weakness in AprolCreateReport affecting B&R APROL versions earlier than 4.4-00P5. The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (8.6 HIGH), indicating network attackability with no privileges or user interaction required and a confidentiality-focused impact. The CSAF record states the outcome may include reading files from the local system.

Defensive priority

High. The issue is network-reachable, unauthenticated, and affects confidentiality of local files, so affected APROL installations should be prioritized for patching or upgrade.

Recommended defensive actions

  • Upgrade B&R APROL to a non-vulnerable version at the earliest convenience, per vendor guidance.
  • Use the vendor user manual to confirm the installed APROL version before remediation.
  • After applying the update, rotate any secrets or passwords that may have been exposed, as recommended in the advisory.
  • Review network exposure for APROL systems and reduce unnecessary access where feasible.
  • Follow CISA and vendor industrial control systems defensive guidance for segmentation, monitoring, and defense-in-depth.

Evidence notes

All core facts are taken from the supplied CISA CSAF advisory and its cited vendor references. The advisory names B&R APROL < 4.4-00P5, the AprolCreateReport component, the code injection weakness, and the potential for an unauthenticated network attacker to read local files. The supplied metadata also includes CVSS 8.6 and the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. No exploit-in-the-wild, KEV, or ransomware claims are included because none were provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-45480 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-45480

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-45480 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-45480

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-093-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.br-automation.com/fileadmin/Cyber_Security_-_Defense_in_Depth_for_BR_Products-bdd37e82.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.br-automation.com/fileadmin/SA24P015-77573c08.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.