B&R Automation Runtime vulnerabilities

An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4, enabling a remote attacker to inject formula data into a generated CSV file. Exploitation requires the attacker to create a malicious link, the user to click it, and then the resulting CSV file to be manually opened.

A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.

Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enable a remote attacker to execute arbitrary JavaScript code in the context of the attacked user's browser session.