CVE-2025-3449
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.
Risk Assessment
The risk includes session hijacking, potentially leading to unauthorized access to automation systems and possible disruption of industrial processes.
Recommendation
Update B&R Automation Runtime to version 6.4 or later, which includes the fix.
Other vulnerabilities in B&R Automation Runtime
See all- CVE-2025-11498Medium
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4, enabling a remote attacker to inject formula data into a generated CSV file. Exploitation requires the attacker to create a malicious link, the user to click it, and then the resulting CSV file to be manually opened.
- CVE-2025-3448Medium
Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enable a remote attacker to execute arbitrary JavaScript code in the context of the attacked user's browser session.
Original NVD description (English source)
A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS