B&R Industrial Automation vulnerabilities
We track 24 vulnerabilities in B&R Industrial Automation products across 37 products. 24 are rated high or critical, and none are known to be exploited. The most recent was published on September 3, 2026.
Latest B&R Industrial Automation vulnerabilities
- 8.7 High severity
mapp Services: Use of Weak Credentials
Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0.
- 7.5 High severity
PPT30 Operating System: Allocation of Resources Without Limits or Throttling
An Allocation of Resources Without Limits or Throttling vulnerability in the OPC-UA Server used in PPT30 Operating System versions before 1.8.0 may be used by an unauthenticated network-based attacker to permanently prevent legitimate users from interacting wi
- 7.4 High severity
B&R Automation Studio: Improper Certificate Validation
An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exch
- 10.0 Critical severity
Automation Runtime: Improper Resource Locking
An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions.
- 8.4 High severity
APROL: External Control of File Name or Path
An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to access data from the file system.
- 8.7 High severity
APROL: Exposure of Sensitive System Information to an Unauthorized Control Sphere
An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMP component of B&R APROL <4.4-00P5 may allow an unauthenticated adjacent-based attacker to read and
- 7.2 High severity
APROL: Allocation of Resources Without Limits or Throttling
An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an unauthenticated adjacent attacker to per-form Denial-of-Service (DoS) attacks against the product.
- 7.0 High severity
APROL: Missing Authentication for Critical Functionality
A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical attacker to alter the boot configuration of the operating system.
- 8.5 High severity
B&R APROL: Inclusion of Functionality from Untrusted Control Sphere
An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands.
- 8.5 High severity
B&R APROL: Incomplete Filtering of Special Elements
An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to authenticate as another legitimate user.
- 9.2 Critical severity
B&R APROL: Improper Control of Generation of Code
An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system.
- 8.5 High severity
APROL: Incorrect Permission Assignment for Critical Resource
An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker to read and alter the configuration of another engineering or runtime user.
- 7.5 High severity
Automation Runtime: Use of a Broken or Risky Cryptographic Algorithm
A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp View versions before 6.1 may be abused by unauthenticated network-based attackers to masquerade as servi
- 8.4 High severity
B&R mapp Cockpit: Authentication Bypass Using an Alternate Path or Channel
An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision befo
- 7.8 High severity
B&R APROL: Untrusted Search Path
An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges.
- 7.8 High severity
B&R APROL: Untrusted Search Path
An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges.
- 7.5 High severity
Automation Runtime: Inadequate Encryption Strength
Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack of B&R Automation Runtime versions before 6.0.2, allowing a network attacker to decrypt the SSL/TLS communication.
- 7.2 High severity
Scene Viewer: Uncontrolled Search Path Element
An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R I
- 8.1 High severity
Automation Studio: Improper Control of Generation of Code
B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sn
- 9.8 Critical severity
Automation Runtime: Use of a Cryptographic Primitive with a Risky Implementation
The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected
- 9.8 Critical severity
B&R VC4: Improper Authentication
Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass the authentication mechanism of the VC4 visualization on affected devices. The imp
- 7.5 High severity
B&R APROL: Unchecked Return Value
B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service.
- 9.8 Critical severity
B&R APROL: Out-of-bounds Write
Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow. This may lead to Denial-of-Service conditions or execution of arbitrary code.
- 7.5 High severity
B&R APROL: Unchecked Return Value
Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07.