B&R Automation manufactures industrial automation control systems and runtime environments, including APROL process automation, Automation Studio development platforms, and the Automation Runtime core execution engine alongside gateway appliances. The vendor's vulnerability disclosures span a modestly represented footprint within the broader vulnerability landscape, concentrated in these tightly coupled automation and control products rather than a diversified portfolio. Weaknesses affecting this vendor lack a clear recurring pattern across the disclosed issues, reflecting the vendor-specific nature of industrial automation software where flaws often arise from unique design choices and integration points rather than from a shared class of coding practices. Defenders deploying B&R Automation systems should monitor vendor advisories closely and validate patch compatibility with their process control workflows, as remediation timelines in industrial environments often diverge from standard IT urgency; current severity, exploitation, and exposure details are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Br Automation over time
Signals from CVEs in this vendor scope (43 CVEs).
43 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-3450CRITICAL An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker t | Oct 7, 2025 | 10.0 | 33 | NO | NO |
CVE-2021-22289CRITICAL Improper Input Validation vulnerability in the project upload mechanism in B&R Automation Studio version >=4.0 may allow an unauthenticated network attacker to execute code. | Aug 11, 2022 | 9.8 | 31 | NO | NO |
CVE-2023-1617CRITICAL Improper Authentication vulnerability in B&R Industrial Automation B&R VC4 (VNC-Server modules). This vulnerability may allow an unauthenticated network-based attacker to bypass t | Apr 14, 2023 | 9.8 | 30 | NO | NO |
CVE-2022-43764CRITICAL Insufficient validation of input parameters when
changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer
overflow. This may lead to Denial-of | Feb 8, 2023 | 9.8 | 30 | NO | NO |
CVE-2022-43762CRITICAL Lack of verification in B&R APROL
Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages
| Feb 8, 2023 | 9.8 | 30 | NO | NO |
CVE-2019-19872CRITICAL An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. The AprolLoader could be used to inject and execute arbitrary unintended commands via an unspecified a | Nov 27, 2020 | 9.8 | 30 | NO | NO |
CVE-2019-19875CRITICAL An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoke | Nov 27, 2020 | 9.8 | 29 | NO | NO |
CVE-2019-19874CRITICAL An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrary unintended commands | Nov 27, 2020 | 9.8 | 29 | NO | NO |
CVE-2019-19108CRITICAL An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modif | Apr 20, 2020 | 9.4 | 28 | NO | NO |
CVE-2021-22275HIGH Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of se | May 13, 2022 | 8.6 | 27 | NO | NO |
Signals from CVEs in this vendor scope (43 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Br Automation.
Media articles that mention a CVE ID that affects a product developed by Br Automation — matched by CVE ID, not by vendor name.