Summary
An update is available that resolves a vulnerability identified by B&Rs internal security analysis in the product versions listed as affected in this advisory.
An attacker who successfully exploited these vulnerabilities could take over a remote session or execute code in the context of the user’s browser session.
Vulnerabilities 3
-
Medium 6.1
CSV Formula Injection Vulnerability
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation o…
-
Medium 6.1
XSS on SDM
Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser sess…
-
Medium 4.2
Weak Session Token used in Automation Runtime SDM
A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.
Revision history
-
#3
Corrected vendor name from 'ABB' to 'B&R Industrial Automation GmbH' to ensure accurate product matching.
-
#2
Added information about CVE-2025-11498.
-
#1
Initial version.
References
-
B&R Advisory Link
https://www.br-automation.com/fileadmin/SA25P003-178b6a20.pdf