Back to Database
Status published
Medium
CVE-2025-3448
XSS on SDM
Vulnerability Description
Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3448
Credits & Attribution
No credits recorded in the NVD database.
More from B&R Industrial Automation GmbH
View All →CVE-2025-3449
Weak Session Token used in Automation Runtime SDM
Low
2.3
CVE-2025-11498
CSV Formula Injection Vulnerability
Medium
5.3
CVE-2025-11482
Allocation of Resources Without Limits or Throttling in the OPC-UA Server
High
8.7
CVE-2025-11044
Vulnerability on Automation Runtime my cause DoS Conditions
High
8.9
CVE-2025-11043
Improper Server Certificate Validation in Automation Studio
Critical
9.1
Affected Vendor
B&R Industrial Automation GmbH
View all reports →Affected Software
Automation Runtime
Vulnerable Versions:
6.0, 4
Timeline
Official Publish:
October 7th, 2025
Last Modified:
October 8th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N