# ABB B&R Automation Runtime session hijack and XSS flaws

Published: 2026-05-21 · Severity: routine · Sectors: energy, manufacturing, infrastructure
Canonical: https://vorant.io/reports/36830cbb-d47e-50d0-beff-7d80f4736102/abb-b-r-automation-runtime-session-hijack-and-xss-flaws

> Three vulnerabilities in ABB B&R Automation Runtime SDM allow session takeover and code execution; patch to version 6.4.

ABB has released an advisory covering three vulnerabilities in the System Diagnostics Manager (SDM) component of B&R Automation Runtime versions before 6.4. CVE-2025-3449 is a predictable session-ID generation flaw that allows an unauthenticated network attacker to hijack established user sessions. CVE-2025-3448 is a reflected XSS vulnerability in SDM that enables arbitrary JavaScript execution in an authenticated user's browser context via a malicious hyperlink. CVE-2025-11498 is a CSV formula-injection flaw requiring social engineering (user clicks a link, then opens the resulting CSV file). All three are in SDM, which is disabled by default in Automation Runtime 6 but may be enabled in production or test environments.

The vulnerabilities have not been exploited in the wild as of the advisory date. ABB recommends upgrading to Automation Runtime 6.4 for affected customers. Organizations should disable SDM when not required and ensure affected systems are not exposed to untrusted networks. The session-hijacking flaw (CVE-2025-3449) poses the highest risk because it requires no user interaction, though SDM does not currently process session-specific data, limiting the practical impact of takeover.

## Mentioned in this report

- Vulnerabilities: CVE-2025-11498, CVE-2025-3448, CVE-2025-3449

## Detection guidance (public sample)

### Reflected XSS Payload in B&R SDM Request URL

ATT&CK: T1185

Detects HTTP requests to the B&R System Diagnostics Manager (/sdm) whose URL carries script-injection markers. This matches the reflected XSS delivery (CVE-2025-3448) via a malicious hyperlink that runs JavaScript in an authenticated user's session. Such JavaScript could be used to hijack or ride that session. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Reflected XSS Payload in B&R SDM Request URL
id: b51c219c-eb91-5d81-b739-17194aa7c973
status: experimental
description: Detects HTTP requests to the B&R System Diagnostics Manager (/sdm) whose
  URL carries script-injection markers (script tags, javascript URI, inline event
  handlers). Matches the reflected XSS delivery via malicious hyperlink described
  for CVE-2025-3448, which could be used to hijack an authenticated session. Does
  not rely on specific hosts or campaign strings.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-04
tags:
- attack.collection
- attack.t1185
- attack.t1598.003
logsource:
  category: proxy
detection:
  selection_sdm:
    c-uri|contains: /sdm
  selection_xss:
    c-uri|contains:
    - <script
    - '%3Cscript'
    - 'javascript:'
    - onerror=
    - onload=
    - '%3Csvg'
    - '%3Cimg'
    - document.cookie
  condition: selection_sdm and selection_xss
falsepositives:
- Authorized web vulnerability scanners or penetration tests run against SDM-enabled
  controllers
- Security appliances replaying or sandboxing URLs in test traffic
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/36830cbb-d47e-50d0-beff-7d80f4736102/abb-b-r-automation-runtime-session-hijack-and-xss-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup