ABB B&R Automation Runtime session hijack and XSS flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Three vulnerabilities in ABB B&R Automation Runtime SDM allow session takeover and code execution; patch to version 6.4.
ABB has released an advisory covering three vulnerabilities in the System Diagnostics Manager (SDM) component of B&R Automation Runtime versions before 6.4. CVE-2025-3449 is a predictable session-ID generation flaw that allows an unauthenticated network attacker to hijack established user sessions. CVE-2025-3448 is a reflected XSS vulnerability in SDM that enables arbitrary JavaScript execution in an authenticated user's browser context via a malicious hyperlink. CVE-2025-11498 is a CSV formula-injection flaw requiring social engineering (user clicks a link, then opens the resulting CSV file). All three are in SDM, which is disabled by default in Automation Runtime 6 but may be enabled in production or test environments.
The vulnerabilities have not been exploited in the wild as of the advisory date. ABB recommends upgrading to Automation Runtime 6.4 for affected customers. Organizations should disable SDM when not required and ensure affected systems are not exposed to untrusted networks. The session-hijacking flaw (CVE-2025-3449) poses the highest risk because it requires no user interaction, though SDM does not currently process session-specific data, limiting the practical impact of takeover.
Mentioned in this report
Detection guidance
Reflected XSS Payload in B&R SDM Request URL
Detects HTTP requests to the B&R System Diagnostics Manager (/sdm) whose URL carries script-injection markers. This matches the reflected XSS delivery (CVE-2025-3448) via a malicious hyperlink that runs JavaScript in an authenticated user's session. Such JavaScript could be used to hijack or ride that session. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Payload in B&R SDM Request URL
id: b51c219c-eb91-5d81-b739-17194aa7c973
status: experimental
description: Detects HTTP requests to the B&R System Diagnostics Manager (/sdm) whose
URL carries script-injection markers (script tags, javascript URI, inline event
handlers). Matches the reflected XSS delivery via malicious hyperlink described
for CVE-2025-3448, which could be used to hijack an authenticated session. Does
not rely on specific hosts or campaign strings.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-04
tags:
- attack.collection
- attack.t1185
- attack.t1598.003
logsource:
category: proxy
detection:
selection_sdm:
c-uri|contains: /sdm
selection_xss:
c-uri|contains:
- <script
- '%3Cscript'
- 'javascript:'
- onerror=
- onload=
- '%3Csvg'
- '%3Cimg'
- document.cookie
condition: selection_sdm and selection_xss
falsepositives:
- Authorized web vulnerability scanners or penetration tests run against SDM-enabled
controllers
- Security appliances replaying or sandboxing URLs in test traffic
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs