# cve.now: B&r Industrial Automation

The newest entries naming B&r Industrial Automation as an affected vendor (up to 200), of 49 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-79679](https://cve.now/CVE-2026-79679.md): Use of Weak Credentials (CVSS 8.7)
- [CVE-2026-6901](https://cve.now/CVE-2026-6901.md): Untrusted Search Path (CVSS 7.7)
- [CVE-2026-6900](https://cve.now/CVE-2026-6900.md): Improper Certificate Validation (CVSS 7.4)
- [CVE-2025-11482](https://cve.now/CVE-2025-11482.md): Allocation of Resources Without Limits or Throttling in the OPC-UA Server (CVSS 7.5)
- [CVE-2026-0936](https://cve.now/CVE-2026-0936.md): Insertion of Sensitive Information into Logfile (CVSS 5.1)
- [CVE-2025-11044](https://cve.now/CVE-2025-11044.md): Vulnerability on Automation Runtime my cause DoS Conditions (CVSS 8.9)
- [CVE-2025-11043](https://cve.now/CVE-2025-11043.md): Improper Server Certificate Validation in Automation Studio (CVSS 9.1)
- [CVE-2025-11498](https://cve.now/CVE-2025-11498.md): CSV Formula Injection Vulnerability (CVSS 5.3)
- [CVE-2025-3449](https://cve.now/CVE-2025-3449.md): Weak Session Token used in Automation Runtime SDM (CVSS 2.3)
- [CVE-2025-3448](https://cve.now/CVE-2025-3448.md): XSS on SDM (CVSS 5.1)
- [CVE-2025-3450](https://cve.now/CVE-2025-3450.md): Automation Runtime SDM requests may impact system (CVSS 9.3)
- [CVE-2024-10210](https://cve.now/CVE-2024-10210.md): Path traversal in APROL Web Portal (CVSS 8.4)
- [CVE-2024-45484](https://cve.now/CVE-2024-45484.md): Enabled ICMP redirection in B&R APROL (CVSS 7.2)
- [CVE-2024-45483](https://cve.now/CVE-2024-45483.md): Missing GRUB password in B&R APROL (CVSS 7.0)
- [CVE-2024-45482](https://cve.now/CVE-2024-45482.md): Privilege escalation in B&R APROL (CVSS 8.5)
- [CVE-2024-45481](https://cve.now/CVE-2024-45481.md): Improper authentication in SSH of B&R APROL (CVSS 8.5)
- [CVE-2024-45480](https://cve.now/CVE-2024-45480.md): Unauthorized local file reading in B&R APROL (CVSS 9.2)
- [CVE-2024-10209](https://cve.now/CVE-2024-10209.md): Incorrect Permission Assignment in APROL file system (CVSS 8.5)
- [CVE-2024-10208](https://cve.now/CVE-2024-10208.md): Cross Site Scripting vulnerability in APROL Web Portal (CVSS 5.1)
- [CVE-2024-10207](https://cve.now/CVE-2024-10207.md): Server-Side Request Forgery (authenticated) in APROL Web Portal (CVSS 5.3)
- [CVE-2024-10206](https://cve.now/CVE-2024-10206.md): Server-Side Request Forgery (unauthenticated) in APROL Web Portal (CVSS 6.9)
- [CVE-2024-8315](https://cve.now/CVE-2024-8315.md): Improper Handling of Insufficient Permissions or Privileges in B&R APROL (CVSS 6.8)
- [CVE-2024-8314](https://cve.now/CVE-2024-8314.md): Improper session handling in B&R APROL (CVSS 5.5)
- [CVE-2024-8313](https://cve.now/CVE-2024-8313.md): Default or Guessable SNMP community names in B&R APROL (CVSS 8.7)
- [CVE-2024-8603](https://cve.now/CVE-2024-8603.md): A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6 (CVSS 8.2)
- [CVE-2024-10490](https://cve.now/CVE-2024-10490.md): Authentication bypass flaw in several mapp components (CVSS 8.4)
- [CVE-2024-5624](https://cve.now/CVE-2024-5624.md): Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL (CVSS 5.1)
- [CVE-2024-5623](https://cve.now/CVE-2024-5623.md): Untrusted search path vulnerability in B&R APROL (CVSS 5.4)
- [CVE-2024-5622](https://cve.now/CVE-2024-5622.md): Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL (CVSS 7.3)
- [CVE-2024-5801](https://cve.now/CVE-2024-5801.md): IP Forwarding enabled in B&R Automation Runtime (CVSS 5.3)
- [CVE-2024-5800](https://cve.now/CVE-2024-5800.md): Diffie-Hellman groups with insufficient strength used in SSL/TLS stack of B&R Automation Runtime (CVSS 8.3)
- [CVE-2021-22280](https://cve.now/CVE-2021-22280.md): DLL Hijacking Vulnerability in Automation Studio (CVSS 7.2)
- [CVE-2024-2637](https://cve.now/CVE-2024-2637.md): Insecure Loading of Code in B&R Products (CVSS 7.2)
- [CVE-2024-0220](https://cve.now/CVE-2024-0220.md): B&R products use insufficient communication encryption (CVSS 8.3)
- [CVE-2023-6028](https://cve.now/CVE-2023-6028.md): SDM Web interface vulnerable to XSS (CVSS 6.1)
- [CVE-2024-0323](https://cve.now/CVE-2024-0323.md): FTP uses unsecure encryption mechanisms (CVSS 9.8)
- [CVE-2021-22281](https://cve.now/CVE-2021-22281.md): Zip Slip Vulnerability in B&R Automation Studio Project Import (CVSS 6.3)
- [CVE-2020-24682](https://cve.now/CVE-2020-24682.md): Automation Studio and PVI Multiple unquoted service path vulnerabilities (CVSS 7.2)
- [CVE-2020-24681](https://cve.now/CVE-2020-24681.md): Automation Studio and PVI Multiple incorrect permission assignments for services (CVSS 8.2)
- [CVE-2021-22282](https://cve.now/CVE-2021-22282.md): RCE in B&R Automation Studio with crafted project files (CVSS 8.3)
- [CVE-2023-3242](https://cve.now/CVE-2023-3242.md): Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime \<G4.93 allows unauthenticated netw (CVSS 8.6)
- [CVE-2023-1617](https://cve.now/CVE-2023-1617.md): Improper Authentication Mechanism in B&R VC4 Visualization (CVSS 9.8)
- [CVE-2022-4286](https://cve.now/CVE-2022-4286.md): Reflected Cross-Site Scripting Vulnerabilities in Automation Runtime (CVSS 6.1)
- [CVE-2022-43765](https://cve.now/CVE-2022-43765.md): DoS in APROLs Tbase server (CVSS 7.5)
- [CVE-2022-43764](https://cve.now/CVE-2022-43764.md): Buffer overflow when changing configuration on Tbase Server (CVSS 9.8)
- [CVE-2022-43763](https://cve.now/CVE-2022-43763.md): Lack of checking preconditions in APROL (CVSS 7.5)
- [CVE-2022-43762](https://cve.now/CVE-2022-43762.md): Memory leak when receiving messages in APROL Tbase server (CVSS 7.5)
- [CVE-2022-43761](https://cve.now/CVE-2022-43761.md): Lack of authentication when managing APROL database (CVSS 9.4)
- [CVE-2021-22289](https://cve.now/CVE-2021-22289.md): RCE through Project Upload from Target (CVSS 8.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/b-and-r-industrial-automation
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.