Quick answers
- Is CVE-2025-3450 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-3450 being exploited in the wild.
- How severe is CVE-2025-3450?
- High severity, with a CVSS score of 10, published 26 May 2026.
- Which products and versions are affected?
- B&R Industrial Automation Automation Runtime < 6.3, < Q4.93.
- Is there a fix for CVE-2025-3450?
- A patch was published on 2026-05-26: Vendor fix available in versions 6.3 and Q4.93 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-3450 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2025-3450?
- Check whether you run B&R Industrial Automation Automation Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An improper resource locking vulnerability (CWE-413) exists in the System Diagnostics Manager (SDM) component of B&R Automation Runtime. The SDM is a web-based diagnostic interface served by the Automation Runtime webserver. An unauthenticated network-based attacker can exploit this by sending specially crafted messages to the affected system node. Successful exploitation allows the attacker to delete data or cause a denial of service (DoS) condition, effectively stopping the controller. The vulnerability is addressed in Automation Runtime versions 6.3 and Q4.93. Mitigation includes disabling SDM, which is the default state in version 6.0 and later.
Affected products
- B&R (ABB) Automation Runtime < 6.3, < Q4.93
Timeline
- 2026-05-26: advisory: CISA Advisory ICSA-26-146-04 published
- 2026-05-26: patched: Vendor fix available in versions 6.3 and Q4.93