B&R Industrial Automation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-79679 Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services.High 7 · Sep 3, 2026
• CVE-2026-6901 Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL.High 8.4 · Jul 6, 2026
• CVE-2026-6900 Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL.Critical 9.1 · Jul 6, 2026
• CVE-2025-11482 An Allocation of Resources Without Limits or Throttling vulnerability in the OPC-UA Server used in PPT30 Operating System versions before 1.8.0 may be used by High 8.7 · May 26, 2026
• CVE-2025-11044 An Allocation of Resources Without Limits or Throttling vulnerability in the ANSL-Server component of B&R Automation Runtime versions prior to 6.5 and prior to High 8.9 · Jan 19, 2026
• CVE-2025-11043 An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauCritical 9.1 · Jan 19, 2026
• CVE-2025-3450 An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated netwCritical 9.3 · Oct 7, 2025
• CVE-2024-10210 An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to High 8.4 · Mar 25, 2025
• CVE-2024-8313 An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMHigh 8.7 · Mar 25, 2025
• CVE-2024-45484 An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an unaHigh 7.2 · Mar 25, 2025
• CVE-2024-45483 A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical attacker to High 7 · Mar 25, 2025
• CVE-2024-45482 An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker froHigh 8.5 · Mar 25, 2025
• CVE-2024-45481 An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to auHigh 8.5 · Mar 25, 2025
• CVE-2024-45480 An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticateCritical 9.2 · Mar 25, 2025
• CVE-2024-10209 An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker toHigh 8.5 · Mar 25, 2025
• CVE-2024-8603 A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp ViewHigh 8.2 · Jan 15, 2025
• CVE-2024-10490 An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapHigh 8.4 · Dec 2, 2024
• CVE-2024-5622 An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker tHigh 7.3 · Aug 29, 2024
• CVE-2024-5800 Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack of B&R Automation Runtime versions before 6.0.2, allowing a network attacker to dHigh 8.3 · Aug 12, 2024
• CVE-2021-22280 Improper DLL loading algorithms in B&R Automation Studio versions >=4.0 and <4.12 may allow an authenticated local attacker to execute code in the context of thHigh 7.2 · May 14, 2024
• CVE-2024-2637 An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial AutomaHigh 7.2 · May 14, 2024
• CVE-2024-0220 B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers.High 8.3 · Feb 22, 2024
• CVE-2024-0323 The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1.Critical 9.8 · Feb 5, 2024
• CVE-2020-24682 Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with ElevHigh 7.2 · Feb 2, 2024
• CVE-2021-22282 Improper Control of Generation of Code ('Code Injection') vulnerability in B&R Industrial Automation Automation Studio allows Local Execution of Code.This issueHigh 8.3 · Feb 2, 2024