CVE-2024-8313: B&R APROL SNMP Information Disclosure Flaw

CVE-2024-8313 Overview

CVE-2024-8313 affects the Simple Network Management Protocol (SNMP) component of B&R APROL versions prior to 4.4-00P5. The vulnerability combines Exposure of Sensitive System Information to an Unauthorized Control Sphere with Initialization of a Resource with an Insecure Default [CWE-497]. An unauthenticated attacker on an adjacent network can read and modify device configuration through SNMP. The flaw stems from insecure default SNMP settings shipped with the product. B&R APROL is a distributed process control system used in industrial environments, making configuration tampering a direct operational risk.

Critical Impact
Adjacent-network attackers can read and alter APROL configuration through SNMP without authentication, compromising confidentiality, integrity, and availability of the control system.

Affected Products

B&R APROL versions prior to 4.4-00P5
SNMP component within the APROL distributed control system
Industrial process control deployments using default SNMP configuration

Discovery Timeline

2025-03-25 - CVE-2024-8313 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8313

Vulnerability Analysis

The vulnerability originates in how the SNMP component of B&R APROL initializes at install time. The service ships with insecure default community strings and access settings, which grant read and write access without additional authentication. Any host with adjacent-network reachability to the SNMP agent can query the management information base (MIB) and issue SET operations against writable objects.

Because SNMP exposes system and configuration data, an attacker gains visibility into the control system topology, running services, and device identifiers. Write access permits modification of configuration parameters that influence device behavior. In an industrial control system (ICS) context, this can disrupt process availability or alter safety-relevant parameters.

The attack requires no user interaction and no prior credentials. The adjacent-network attack vector limits exploitation to attackers with access to the same broadcast domain or logical network segment as the affected device.

Root Cause

The root cause is a resource initialized with an insecure default [CWE-497]. The SNMP agent is provisioned with default community strings and open access policies that expose sensitive system information and permit configuration changes. Administrators who deploy APROL without hardening the SNMP configuration inherit this exposure.

Attack Vector

An attacker positioned on an adjacent network sends SNMP GET, GETNEXT, or WALK requests to enumerate configuration and system data. Using the default write community string, the attacker then issues SET requests to alter parameters exposed by the agent. Exploitation requires only standard SNMP tooling and network reachability to UDP port 161 on the target. See the B&R Automation Technical Document for vendor-provided details.

Detection Methods for CVE-2024-8313

Indicators of Compromise

Unexpected SNMP traffic on UDP port 161 originating from hosts that are not part of the network management infrastructure
SNMP SET operations targeting APROL devices from unauthorized sources
Configuration drift on APROL nodes without a corresponding change-management record
Use of default or weak SNMP community strings such as public or private observed in packet captures

Detection Strategies

Inspect network flow records for SNMP traffic to and from APROL hosts and compare against an approved management source list
Deploy passive ICS network monitoring to alert on SNMP SET requests directed at process-control assets
Audit SNMP agent configuration on APROL systems to identify default community strings and writable views

Monitoring Recommendations

Enable logging on network devices at the boundary of the control network for all SNMP traffic
Alert on any SNMP session that originates outside a defined management VLAN
Correlate SNMP write events with configuration changes on APROL controllers to detect unauthorized modification

How to Mitigate CVE-2024-8313

Immediate Actions Required

Upgrade B&R APROL to version 4.4-00P5 or later to remediate the insecure default configuration
Restrict SNMP access at the network layer to authorized management stations using access control lists
Replace default SNMP community strings with strong, unique values and disable write community access where not required
Segment the control network from corporate and general-purpose networks to reduce adjacent-network exposure

Patch Information

B&R Automation addresses the vulnerability in APROL 4.4-00P5. Refer to the vendor advisory SA24P015 for upgrade instructions and configuration guidance.

Workarounds

Disable the SNMP service on APROL nodes where remote management is not required
Migrate SNMP configuration from version 1 or 2c to SNMPv3 with authentication and privacy enabled
Apply firewall rules that permit UDP 161 only from designated network management systems
Place APROL devices behind an ICS-aware firewall and monitor SNMP traffic for policy violations

bash

# Example: restrict SNMP to a management host using iptables
iptables -A INPUT -p udp --dport 161 -s 10.10.0.5 -j ACCEPT
iptables -A INPUT -p udp --dport 161 -j DROP