Description
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| B&R Industrial Automation | Automation Runtime | 6.0 – < 6.4, 4 | 6.4 |
Advisories 2
- ICSA-26-141-04 ABB B&R Automation Runtime CISA ICS & IT advisories · May 21, 2026
- SA25P003 B&R Automation Runtime Vulnerabilities in System Diagnostic Manager (SDM) ABB PSIRT · May 14, 2026