Vulnerabilities

CVSS

6.1 Medium

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Risk score

48.8

Published

2025-10-07

Status

Deferred

Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session

Weaknesses

CWE-79

Coverage 1

vulnerability

ABB B&R Automation Runtime

This CISA advisory details vulnerabilities within ABB B&R Automation Runtime versions prior to 6.4. Specifically, the System Diagnostic Manager (SDM) component is susceptible to reflected cross-site scripting (XSS) and i…

CISA Advisories · May 21, 2026 High

CVE-2025-3449CVE-2025-3448CVE-2025-11498CHxsscsvsdm

All articles mentioning it

Advisories and references

• br-automation.com/fileadmin/SA25P003-178b6a20.pdf