CVE-2025-3448
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enable a remote attacker to execute arbitrary JavaScript code in the context of the attacked user's browser session.
Risk Assessment
An attacker could execute arbitrary JavaScript in the victim's browser, potentially leading to session data theft or unauthorized actions. The risk affects organizations using B&R Automation Runtime versions before 6.4.
Recommendation
Update B&R Automation Runtime to version 6.4 or later. Avoid clicking unknown links leading to SDM.
Other vulnerabilities in B&R Automation Runtime
See all- CVE-2025-11498Medium
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4, enabling a remote attacker to inject formula data into a generated CSV file. Exploitation requires the attacker to create a malicious link, the user to click it, and then the resulting CSV file to be manually opened.
- CVE-2025-3449Medium
A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.
Original NVD description (English source)
Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session
Vulnerability data from NVD (NIST) · CISA KEV · EPSS