CVE-2025-3448: ABB B&R Automation Runtime multiple vulnerabilities in SDM

CVE-2025-3448 · Severity: high · CVSS 6.1 · Published 2026-05-21

ABB B&R Automation Runtime, a middleware system used to manage industrial control applications, contains multiple vulnerabilities in its System Diagnostics Manager (SDM) component. If exploited, these flaws could allow an attacker to take over active user sessions, execute malicious code in a user's web browser, or inject harmful data into exported diagnostic files. This could lead to unauthorized access to industrial controller information or the compromise of workstations used by plant operators.

Technologies: B&R Industrial Automation Automation Runtime. Vendors: B&R Industrial Automation.

Quick answers

Is CVE-2025-3448 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-3448 being exploited in the wild.
How severe is CVE-2025-3448?
High severity, with a CVSS score of 6.1, published 21 May 2026.
Which products and versions are affected?
B&R Industrial Automation Automation Runtime < 6.4.
Is there a fix for CVE-2025-3448?
A patch was published on 2026-05-21: Vulnerabilities fixed in Automation Runtime 6.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-3448 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2025-3448?
Check whether you run B&R Industrial Automation Automation Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Three distinct vulnerabilities exist in the System Diagnostics Manager (SDM) component of ABB B&R Automation Runtime versions prior to 6.4. CVE-2025-3449 involves the generation of predictable session identifiers, allowing unauthenticated network attackers to hijack established sessions. CVE-2025-3448 is a reflected cross-site scripting (XSS) vulnerability that enables the execution of arbitrary JavaScript in a user's browser context via malicious links. CVE-2025-11498 is a CSV injection (formula injection) flaw where an attacker can inject malicious formulas into generated CSV files, which may execute when the file is opened in spreadsheet software. All vulnerabilities require some level of user interaction, such as clicking a link or opening a file. These issues are resolved in Automation Runtime version 6.4.

Affected products

  • ABB B&R Automation Runtime < 6.4

Identifiers

  • CVE-2025-3448
  • CVE-2025-3449
  • CVE-2025-11498

Timeline

  • 2026-05-21: advisory: CISA published advisory ICSA-26-141-04
  • 2026-05-21: patched: Vulnerabilities fixed in Automation Runtime 6.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.