B&R APROL Missing Authentication for Critical Function Vulnerability Allowing Boot Configuration Alteration

A vulnerability has been identified in B&R APROL versions prior to 4.4-01, allowing an unauthenticated physical attacker to modify the operating system's boot configuration. This issue arises from missing authentication for critical functions in the GRUB configuration.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the boot configuration, potentially allowing for privilege escalation or manipulation of the operating system's startup process.

Remediation

Users are advised to upgrade to B&R APROL version 4.4-01 or later. Instructions for installing updates are available in the user manual. After applying the update, it is recommended to change all passwords and secrets, as some vulnerabilities may have compromised credential confidentiality.