Vulnerabilities

CVSS

4.2 Medium

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Risk score

33.6

Published

2025-10-07

Status

Deferred

A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.

Weaknesses

CWE-340

Coverage 1

vulnerability

ABB B&R Automation Runtime

This CISA advisory details vulnerabilities within ABB B&R Automation Runtime versions prior to 6.4. Specifically, the System Diagnostic Manager (SDM) component is susceptible to reflected cross-site scripting (XSS) and i…

CISA Advisories · May 21, 2026 High

CVE-2025-3449CVE-2025-3448CVE-2025-11498CHxsscsvsdm

All articles mentioning it

Advisories and references

• br-automation.com/fileadmin/SA25P003-178b6a20.pdf