CVE-2019-19875

CRITICAL

B&R Industrial Automation APROL < R4.2 - OS Command Injection via AprolCluster Script

Title source: llm

Description

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://www.br-automation.com/downloads_br_productcatalogue/BRP44400000000000000585952/APROL_R42_A1_ReleaseNotes_001.pdf

Scores

CVSS v3 9.8

EPSS 0.0150

EPSS Percentile 71.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-77

Status published

Products (1)

br-automation/industrial_automation_aprol < r4.2

Published Nov 27, 2020

Tracked Since Feb 18, 2026