The vulnerabilities exposed the system’s database to attacks

The Austrian company B&R¹, part of the ABB group, thanked Natalya Tlyapova, Senior Security Researcher at Application Analysis at Positive Technologies, for discovering five database vulnerabilities in the APROL industrial process control system. The solution is used in various industries, including energy, oil and gas, engineering, and food. The vendor was notified of the threat as part of the responsible disclosure policy and fixed the vulnerabilities in new versions of the sotware.

Two more vulnerabilities found by Natalya Tlyapova—CVE-2022-43763 and CVE-2022-43765, both with 7.5 score—made denial-of-service attacks possible.

Users must install patched versions of the APROL system (R 4.2-07 with AutoYaST or V4.2-070.0.120102). These updates ensure secure access to the database using TLS encryption².

To search for traces of information security violations in ICS networks and discover cyberattacks at early stages, Positive Technologies offers a hardware and software suite for deep analysis of industrial traffic, PT Industrial Security Incident Manager (PT ISIM), which can detect exploitation of the APROL vulnerabilities described here. PT ISIM is part of the PT Industrial Cybersecurity Suite, a platform for cyberthreat detection and incident response in industrial systems.

This is not the first time Positive Technologies’ research has allowed B&R to improve the security of its products. In 2019, Positive Technologies helped fix multiple vulnerabilities in 12 components of the B&R APROL system.

1. B&R Industrial Automation is a European manufacturer of industrial automation components. In 2017, B&R was acquired by ABB.
2. The TLS and SSL protocols use asymmetric encryption for authentication.