Summary: reporting the vulnerabilities through responsible disclosure and provided valuable input on product improvements.

Summary

Support

Notice

To attack with this kind of message, hackers must hijack CSMS (OCPP backends) first and then can send messages, OR the way to OCPP backend is unsafe itself (http) which can cause any kind of attack behavior and known as a common knowledge.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

Make sure OCPP backend that chargers are connected is strictly secured to avoid any kind of at-tack especially the communication relevant components.

Use https(TLS) as basic communication foundation between charger and OCPP backend instead of http.

Workarounds

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind fire-walls and separate them from any general-purpose network (e.g. office or home networks).

–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

–	Never connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.

–	Scan all data imported into your environment before use to detect potential malware infections.

–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.

–	Ensure all nodes are always up to date in terms of installed software, operating system, and firm-ware patches as well as anti-virus and firewall.

–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user com-munity in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely in-formation which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?

The vulnerability is caused by firmware which it didn’t limit the length of OCPP field in certain case.

What is Terra AC wallbox?

Terra AC wallbox is a Level 2 Electric Vehicle charger.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited this vulnerability could cause the affected system node to take control of the charger to response wrong messages, Denial-of-Service, compromised internal state, and possibly remote code execution.

How could an attacker exploit the vulnerability?

An attacker could try to exploit the vulnerability by sending a specially crafted OCPP message to chargers via OCPP backend(CSMS), which could be done remotely. This would require that the attacker has access to the system network and hijack the API of sending message OR hijack the network data directly if the charger is connected with unsafe http mode.

Recommended practices help mitigate such attacks, see section Mitigating Factors above.

Could the vulnerability be exploited remotely?

Yes, an attacker who has network access to an affected system node could exploit this vulnerability.

Can functional safety be affected by an exploit of this vulnerability?

The charger potentially is running with unpredictable mode, including Denial-of-Service, compromised internal state, and possibly remote code execution.

What does the update do?

The update removes the vulnerability by modifying the validation rules of receiving data from OCPP backend.

When this security advisory was issued, had this vulnerability been publicly disclosed?

No, ABB received information about this vulnerability through responsible disclosure.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?

No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued

Frequently asked questions

Summary: ABB E-mobility, "The home of charging, Terra AC wallbox," [Online]. Available:

Summary: ABB E-mobility, "Installation Manual, Terra AC (BCM.V3Y01.0-EN)," [Online]. Available:

Summary: Initial version.

Summary: Final version

ABB

Terra AC wallbox (UL40/80A)

ABB Terra AC wallbox (UL40/80A) <=1.8.32

Terra AC wallbox (MID/ CE)

Terra AC MID

ABB Terra AC wallbox (MID/ CE) Terra AC MID  <=1.8.32

ABB Terra AC wallbox (MID/ CE) Terra AC MID  1.8.34

Terra AC Juno CE

ABB Terra AC wallbox (MID/ CE) Terra AC Juno CE <=1.8.32

ABB Terra AC wallbox (MID/ CE) Terra AC Juno CE 1.8.34

Terra AC PTB

ABB Terra AC wallbox (MID/ CE) Terra AC PTB <=1.8.21

ABB Terra AC wallbox (MID/ CE) Terra AC PTB 1.8.33

There is potential risk to pollute the memory when a specially crafted OCPP message may be sent to a target vulnerable charger by exploiting unencrypted communication to the Charging Station Management System (CSMS) or fully remotely from its CSMS server.

CVE description

Summary: NVD - CVE-2025-5517

The problem is corrected in the product versions listed as fixed in the advisory.

Terra AC wallbox (UL40/80A) 1.8.33

Terra AC wallbox (UL32A) 1.8.34

Terra AC MID 1.8.34

Terra AC Juno CE 1.8.34

Terra AC PTB 1.8.33

Terra AC wallbox (JP) 1.8.34

Additionally, we strongly recommend not use unsafe mode(http) to connect your charger to your backend even though OCPP is allowed to do in this way, which absolutely could be attacked by malicious man or organization as a common knowledge.

ABB recommends that customers apply the update at earliest convenience.

CVE-2025-5517


ABB became aware of severe vulnerability in the products versions listed as affected in the advisory, if the optional integration with Azure Active Directory for Single-Sign On is enabled. We have not received any reports of this vulnerability being exploited.

An attacker who successfully exploits this vulnerability could bypass user authentication and potentially cause the product to:
- Shutdown the system,
- Modify the configuration of the system,
- Install and run arbitrary code

Summary

For additional instructions and support please contact your local ABB service organization. For contact information, see www.abb.com/contactcenters.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by ABB.

ABB provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall ABB or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if ABB or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from ABB, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For any installation of software-related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

- Isolate special purpose networks (e.g. for automation systems) and remote devices behind fire-walls and separate them from any general-purpose network (e.g. office or home networks).
- Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
- Never connect programming software or computers containing programming software to any network other than the network for the devices that it is intended for.
- Scan all data imported into your environment before use to detect potential malware infections.
- Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
- Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
- When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

ABB has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, ABB immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If ABB is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of ABB’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?
- The vulnerability is caused by the possibility to inject code in the authentication script responsible for integration with Azure Active Directory.

What is ABB OPTIMAX?
- OPTIMAX is a software suite that delivers energy management and optimization for energy, emissions, and processes. It provides coordinated control of multiple assets targeting energy efficiency and decarbonization. OPTIMAX is an optimization environment for solving all types of energy management and optimization challenges that industrial enterprises and energy provider face.

What might an attacker use the vulnerability to do?
- An attacker who successfully exploited this vulnerability could run arbitrary code on OPTIMAX and modify the configuration of the system.

How could an attacker exploit the vulnerability?
- An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected OPTIMAX system. This would require that the attacker has access to the system
network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the network with malicious software. Recommended practices help mitigate such attacks, see section Mitigating Factors above

Could the vulnerability be exploited remotely?
- Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

What does the update do?
- The update removes the vulnerability by preventing injection vectors in the authentication script.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- No, ABB discovered this vulnerability through internal testing.

When this security advisory was issued, had ABB received any reports that this vulnerability was being exploited?
- No, ABB had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

Summary: ABB CYBERSECURITY ADVISORY - PDF Version

Summary: ABB CYBERSECURITY ADVISORY - CSAF Version

Summary: 9AKK108472A0435 - OPTIMAX OS Update don_osupdate_v6.4.1-20251120

Summary: 9AKK108472A0437 - OPTIMAX OS Update don_osupdate_v6.3.1-20251120

ABB Ability™ OPTIMAX® Authentication Bypass in Single-Sign On with  Azure Active Directory

Summary: Initial version.

Incorrect Implementation of Authentication Algorithm

The vulnerability allows an attacker to bypass user authentication on OPTIMAX installations that make use of the Azure Active Directory Single-Sign On integration.

CVE description

Summary: NVD - CVE-2025-14510

The problem is corrected in the following product versions:
- ABB Ability OPTIMAX v6.4.1-251120 (see References 9AKK108472A0435) or later
- ABB Ability OPTIMAX v6.3.1-251120 (see References 9AKK108472A0437) or later

ABB recommends that customers using earlier versions of OPTIMAX v6.4 and OPTIMAX v6.3 apply an update of the operating system at earliest convenience. Customers still using the meanwhile unsupported OPTIMAX v6.2 or v6.1 shall contact ABB to identify the right way forward.

Exploitation requires three preconditions:
- OPTIMAX is configured to integrate with Azure Active Directory,
- An attacker has a network communication channel with OPTIMAX,
- An attacker knows a valid username on the OPTIMAX system other than the default username.
Refer to section “General security recommendations” for further advise on how to keep your system secure.

CVE-2025-14510


ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is now available that addresses and remediates the vulnerability.

A network attacker could exploit the vulnerabilities to execute remote code, initiate DoS attacks, conduct DNS cache poisoning, or extract sensitive information.

Summary

For additional instructions and support please contact your local B&R service organization. For contact information, see https://www.br-automation.com/en/about-us/locations/.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by B&R.

B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For any installation of software related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

– Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls
and separate them from any general purpose network (e.g. office or home networks).

– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

– Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.

– Scan all data imported into your environment before use to detect potential malware infections.

– Minimize network exposure for all applications and endpoints to ensure that they are not accessible
from the Internet unless they are designed for such exposure and the intended use requires such.

– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware
patches as well as anti-virus and firewall.

– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

General security recommendations

B&R has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, B&R immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If B&R is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of B&R’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What is the scope of the vulnerabilities?
- A network attacker who successfully exploited these vulnerabilities to execute remote code, initiate DoS attacks, conduct DNS cache poisoning, or extract sensitive information. In worst case, these vulnerabilities can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

What causes the vulnerabilities?
- The vulnerabilities are caused by usage of vulnerable UEFI firmware in some B&R xPCs.

What is a B&R xPC?
- A B&R xPC is an industrial PC (IPC) designed for use in industrial environments and is built to handle more demanding conditions than a standard PC. They often feature robust construction, resistance to dust and moisture, extended temperature ranges, and other specifications suited for industrial applications.

What might an attacker use the vulnerabilities to do?
- A network attacker who successfully exploited the vulnerabilities could execute remote code, initiate DoS attacks, conduct DNS cache poisoning, or extract sensitive information.

How could an attacker exploit the vulnerabilities?
- An attacker could try to exploit the vulnerabilities by creating a specially crafted message and sending the message to an affected system node. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the network with malicious software. Recommended practices help mitigate such attacks, see section Mitigating Factors above.

Could the vulnerabilities be exploited remotely?
- Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

What does the update do?
- The update removes the vulnerabilities in the TCP/IP stack used by the UEFI firmware.

When this security advisory was issued, had these vulnerabilities been publicly disclosed?
- Yes, these vulnerabilities have been publicly disclosed.

When this security advisory was issued, had B&R received any reports that this vulnerability was being exploited on B&R products?
- No, B&R had not received any information indicating that this vulnerability had been exploited on B&R products when this security advisory was originally issued.

Frequently Asked Questions

B&R PCs vulnerable to PixieFail attack

Summary: Initial version.

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

CVE description

Summary: NVD - CVE-2023-45229

The problems are corrected in the following product versions:

- APC4100 1.09
- APC910 No patch will be released (Please refer to the mitigation measures specified in this advisory).
- C80 1.14
- MPC3100 1.24
- PPC1200 1.14
- PPC900 2.16
- APC2200 1.35
- PPC2200 1.35
- APC3100 1.45
- PPC3100 1.45

B&R recommends that customers apply the update at earliest convenience.

The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

Deactivate the vulnerable component
- The vulnerabilities exist in the Preboot eXecution Environment (PXE) of the UEFI firmware. If this functionality is not needed, it is recommended to disable it in the UEFI settings, thus making the vulnerabilities not exploitable.

Limit accessibility
- If PXE functionality is required, users should tightly restrict network traffic to legitimate users and block illegitimate PXE traffic, specifically related to IPv6. For instance, by blocking IPv6 network traffic on the control network firewall.

https://help.br-automation.com/#/en/6/cyber-security/defense-in-depth-for-br-products/reference_architecture.html

Refer to section “General security recommendations” for further advise on how to keep your system secure.

CVE-2023-45229

Improper Restriction of Operations within the Bounds of a Memory Buffer

EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

CVE description

Summary: NVD - 2023-45230

CVE-2023-45230

EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

CVE description

Summary: NVD - CVE-2023-45231

CVE-2023-45231

Loop with Unreachable Exit Condition ('Infinite Loop')

EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.

CVE description

Summary: NVD - CVE-2023-45232

CVE-2023-45232

EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.

CVE description

Summary: NVD - CVE-2023-45233

CVE-2023-45233

EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

CVE description

Summary: NVD - CVE-2023-45234

CVE-2023-45234

EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.

CVE description

Summary: NVD - CVE-2023-45235

CVE-2023-45235

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

CVE description

Summary: NVD - CVE-2023-45236

CVE-2023-45236

CVE description

Summary: NVD - CVE-2023-45237

CVE-2023-45237


Updates are available that resolve privately reported vulnerabilities in the product versions listed as affected in this advisory.

An attacker who successfully exploits these vulnerabilities could elevate privileges or gather sensitive information.

Summary

Mitigating factors describe conditions and circumstances that make an attack that exploits the vulnerability difficult or less likely to succeed. Please refer to “General security recommendations” to get general guidelines how to mitigate threats on IACS.
B&R can support customers with various measures to mitigate the listed vulnerabilities. Please contact APROL Support for assistance.

Mitigating factors

For any installation of software-related B&R products we strongly recommend the following (non-exhaustive) list of cyber security practices:
–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
–	Never connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.
–	Scan all data imported into your environment before use to detect potential malware infections.
–	Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
–	Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
More information on recommended practices can be found in the following documents:(Defense in Depth for B&R products)

General security recommendations

The information in this document is subject to change without notice, and should not be construed as a commitment by B&R.
B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

For additional instructions and support please contact your local B&R service organization. For contact information, see https://www.br-automation.com/en/about-us/locations/.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

Summary: B&R Advisory Link

Summary: Recommended practices can be found in the following documents: Defense in Depth for B&R products

Summary: B&R CYBERSECURITY ADVISORY - CSAF version.

B&R APROL Potential Privilege Escalation and Information Disclosure

Summary: Initial version.

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands.

CVE Description

Summary: NVD - CVE-2024-45482

B&R recommends that customers apply the patch or upgrade to a non-vulnerable version at their earliest convenience.
The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.
As some of the vulnerabilities affect the confidentiality of credentials, it is recommended to change all secrets/passwords after applying the update.

CVE-2024-45482

An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to authenticate as another legitimate user.

description

Summary: NVD - CVE-2024-45481

CVE-2024-45481

Improper Control of Generation of Code ('Code Injection')

An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system.

CVE Description

Summary: NVD - CVE-2024-45480

CVE-2024-45480

An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker to read credential information.

CVE Description

Summary: NVD - CVE-2024-8315

CVE-2024-8315

An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an unauthenticated adjacent attacker to per-form Denial-of-Service (DoS) attacks against the product.

CVE Description

Summary: NVD - CVE-2024-45484

CVE-2024-45484

A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical attacker to alter the boot configuration of the operating system.

CVE Description

Summary: NVD - CVE-2024-45483

CVE-2024-45483

An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMP component of B&R APROL <4.4-00P5 may allow an unauthenticated adjacent-based attacker to read and alter configuration using SNMP.

CVE Description

Summary: NVD - CVE-2024-8313

CVE-2024-8313

An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Session vulnerability in the session handling used in B&R APROL <4.4-00P5 may allow an authenticated network attacker to take over a currently active user session without login credentials.

CVE Description

Summary: NVD - CVE-2024-8314

CVE-2024-8314

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force the web server to request arbitrary URLs.

CVE Description

Summary: NVD - CVE-2024-10206

CVE-2024-10206

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the web server to request arbitrary URLs

CVE Description

Summary: NVD - CVE-2024-10207

CVE-2024-10207

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user’s browser session.

CVE Description

Summary: NVD - CVE-2024-10208

CVE-2024-10208

An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to access data from the file system.

CVE Description

Summary: NVD - CVE-2024-10210

CVE-2024-10210

An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker to read and alter the configuration of another engineering or runtime user.

CVE Description

Summary: NVD - CVE-2024-10209

CVE-2024-10209


An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory.

An attacker who successfully exploited this vulnerability may masquerade as services on affected devices.

Summary

The mechanism of creating self signed certificates on B&R Automation Runtime and B&R mapp View
during bootup is only intended for testing and not for production machines. Please use always a proper SSL/TLS configuration in B&R Automation Studio including certificates signed by a trusted certificate authority for machines used in production environments.

Workarounds

For any installation of software related B&R products we strongly recommend the following (non-exhaustive) list of cyber security practices:
– Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls
and separate them from any general purpose network (e.g. office or home networks).
– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
– Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
– Scan all data imported into your environment before use to detect potential malware infections.
– Minimize network exposure for all applications and endpoints to ensure that they are not accessible
from the Internet unless they are designed for such exposure and the intended use requires such.
– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware
patches as well as anti-virus and firewall.
– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
More information on recommended practices can be found in the reference section (Defense in Depth for B&R products )

General security recommendations

For additional instructions and support please contact your local B&R service organization. For contact
information, see https://www.br-automation.com/en/about-us/locations/.
Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity

Support

The information in this document is subject to change without notice, and should not be construed as a
commitment by B&R.
B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a
particular purpose, for the information contained in this document, and assumes no responsibility for
any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of
this document, or from the use of any hardware or software described in this document, even if B&R or
its suppliers have been advised of the possibility of such damages.
This document and parts hereof must not be reproduced or copied without written permission from
B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.
All rights to registrations and trademarks reside with their respective owners.

Notice

Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

Summary: B&R Advisory Link

Summary: B&R CYBERSECURITY ADVISORY - CSAF Version

Automation Runtime and mapp View Use of insecure algorithm for self-signed certificates

Summary: Initial version.

Summary: Corrected NVD Link

A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in
B&R Automation Runtime versions <6.1 and B&R mapp View versions <6.1 may be abused by unauthenticated network-based attackers to masquerade as services on impacted devices.

CVE Description

Summary: NVD- CVE-2024-8603

The problem is corrected in the following product versions:
B&R Automation Runtime version 6.1.
B&R mapp View 6.1.
B&R recommends that customers apply the update at their earliest convenience if B&R Automation
Runtime or B&R mapp View is used to generate self-signed certificates on production machines.

CVE-2024-8603


An update is available that resolves a vulnerability identified by B&Rs internal security analysis in the product versions listed as affected in this advisory.

An attacker who successfully exploited this vulnerability could cause the product to stop.

Summary

For any installation of software-related B&R products we strongly recommend the following (non-exhaustive) list of cyber security practices:
-Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
-Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
-Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.
-Scan all data imported into your environment before use to detect potential malware infections.
-Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.
-Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.
-When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recog-nize that VPNs may have vulnerabilities and should be updated to the most current version availa-ble. Also, understand that VPNs are only as secure as the connected devices.

More information on recommended practices can be found in the following documents:
Defense in Depth for B&R products

General security recommendations

For additional instructions and support please contact your local B&R service organization. For contact information, see https://www.br-automation.com/en/about-us/locations/.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by B&R.

B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

Deactivate the vulnerable component

The SDM is deactivated by default on Automation Runtime version >=6.0. For Automation Runtime versions <6.0, the SDM can be deactivated in the Automation Studio project. Please refer to Automation Help GUID 1d915d67-07f7-4034-a472-c204b5cabbfe for further guidance.

Access to the System Diagnostic Manager (SDM) shall be restricted to trusted personnel through appropriate external security measures. If SDM is required solely for maintenance purposes, it should be enabled or access granted only for the minimum time necessary to perform the task.

Limit accessibility

B&R recommends in general to configure the HTTP protocol over TLS (HTTPS).

Customers may restrict access to the webserver by configuring mutual TLS (mTLS) in the Automation Studio project (Option “Validate SSL communication partner”). Be aware that configuring mTLS would impact also other applications using the AR webserver (e.g. mapp View). Please refer to Automation Help GUID 01ced6c0-28ef-4aaa-bd05-2442b971859c to learn more about the TLS Configuration in Automation Studio.

In addition, accessibility of the webserver can be limited to trusted IP addresses using the Automation Runtime host-based firewall. Please refer to Automation Help GUID 75b8994b-f97a-4e0f-8278-43c7a737e65f for details.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

B&R has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, B&R immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If B&R is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of B&R’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed

Purpose

What causes the vulnerability?

The vulnerabilities are caused by improper resource locking.

What is System Diagnostics Manager (SDM)?

System Diagnostics Manager (SDM) is a webpage available over the Automation Runtime Webserver, showing key diagnostic information of the running controller

What is Automation Runtime (AR)?

B&R Automation Runtime is a middleware system enabling customers to run applications on B&R target systems.

What might an attacker use the vulnerability to do?

An attacker who successfully exploited these vulnerabilities could cause the affected system node to stop.

How could an attacker exploit the vulnerability?

An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system node. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the network with malicious software. Recommended practices help mitigate such attacks, see section Mitigating Factors above.

Could the vulnerability be exploited remotely?
Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a
minimal number of ports exposed.
When this security advisory was issued, had this vulnerability been publicly disclosed?
No, B&R discovered the vulnerabilities through its own security analysis.
When this security advisory was issued, had B&R received any reports that this
vulnerability was being exploited?
No, B&R had not received any information indicating that this vulnerability had been exploited when this
security advisory was originally issued.

Frequently asked questions

Summary: B&R Advisory Link

B&R Automation Runtime DoS Vulnerability in System Diagnostics Manager (SDM)

Summary: Initial version.

An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions.

CVE Description

Summary: NVD - CVE-2025-3450

The problem is corrected in Automation Runtime versions 6.3 and Q4.93.

The System Diagnostic Manager (SDM) is disabled by default in Automation Runtime 6 and is not in-tended be enabled on active systems located outside properly secured production networks or in facilities lacking adequate physical and logical access controls to prevent any form of unauthorized interaction. For customers who use SDM on their systems, B&R recommends applying the update at the earliest convenience.

The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

CVE-2025-3450


An update is available that resolves a vulnerability identified by B&Rs internal security analysis in the product versions listed as affected in this advisory.

An attacker who successfully exploited these vulnerabilities could take over a remote session or execute code in the context of the user’s browser session.

Summary

For any installation of software-related B&R products we strongly recommend the following (non-exhaustive) list of cyber security practices:
–	Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general-purpose network (e.g. office or home networks).
–	Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.
–	Never connect programming software or computers containing programing software to any net-work other than the network for the devices that it is intended for.
–	Scan all data imported into your environment before use to detect potential malware infections.
–	Minimize network exposure for all applications and endpoints to ensure that they are not accessi-ble from the Internet unless they are designed for such exposure and the intended use requires such.
–	Ensure all nodes are always up to date in terms of installed software, operating system, and firm-ware patches as well as anti-virus and firewall.
–	When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

More information on recommended practices can be found in the following documents:

Defense in Depth for B&R products

General security recommendations

Support

Notice

Do not enable the System Diagnostics Manager when it is not required.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

Mitigating factors

Do not use Hyperlinks provided by untrusted 3rd party to access the SDM. Hyperlinks may be provided via:
•	Emails from unknown users
•	Social media channels
•	Messaging services
•	Webpages with comment functionality
•	QR Codes
The use of external Web Application Firewalls (WAF) can mitigate attacks using reflected cross-site scripting.

Workarounds

Purpose

What causes the vulnerabilities?

The vulnerabilities are caused by insufficient input sanitization and generation of predictable numbers.

What is System Diagnostics Manager (SDM)?

System Diagnostics Manager (SDM) is a webpage available over the Automation Runtime Webserver, showing key diagnostic information of the running controller.

What is Automation Runtime (AR)?

B&R Automation Runtime is a middleware system enabling customers to run applications on B&R target
systems.

What might an attacker use the vulnerabilities to do?

An attacker who successfully exploited these vulnerabilities could cause to run arbitrary code in the context of the user’s browser session or take over the user’s session. Since the SDM currently does not process any session-specific data and also does not implement authentication mechanisms at the session level, B&R is not aware of any advantages an attacker could gain by taking over the session ID

How could an attacker exploit the vulnerabilities?

To exploit the XSS vulnerability CVE-2025-3448, an attacker could try to create a hyperlink including malicious script code. This hyperlink must be opened by the user to launch the attack.

To exploit vulnerability CVE-2025-3449, an attacker would need to guess a user's session ID.

Could the vulnerabilities be exploited remotely?

Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

When this security advisory was issued, had this vulnerability been publicly disclosed?

No, B&R discovered the vulnerabilities through its own security analysis.

When this security advisory was issued, had B&R received any reports that this vulnerability was being exploited?

No, B&R had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently asked questions

Summary: B&R Advisory Link

B&R Automation Runtime Vulnerabilities in System Diagnostic Manager (SDM)

Summary: Initial version.

Summary: Added information about CVE-2025-11498

A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.

CVE Description

Summary: NVD - CVE-2025-3449

The problem is corrected in Automation Runtime 6.4.

The System Diagnostic Manager (SDM) is disabled by default in Automation Runtime 6 and is not intended be enabled on active systems located outside properly secured production networks or in facilities lacking adequate physical and logical access controls to prevent any form of unauthorized interaction. For customers who use SDM on their systems, B&R recommends applying the update based on risk assessment at the earliest convenience.

The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

CVE-2025-3449

Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session

CVE Description

Summary: NVD - CVE-2025-3448

CVE-2025-3448

An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attack-er to create a malicious link. The user would need to click on this link, after which the resulting CSV file additionally needs to be manually opened.

CVE Description

Summary: NVD - CVE-2025-11498

CVE-2025-11498


ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that resolves a vulnerability.

Successful exploitation of this vulnerability may enable an attacker to masquerade as a trusted party when B&R Automation Studio establishes a connection with a server via the ANSL over TLS or OPC-UA protocol.

Summary

For any installation of software related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

– Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls
and separate them from any general-purpose network (e.g. office or home networks).

– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

– Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.

– Scan all data imported into your environment before use to detect potential malware infections.

– Minimize network exposure for all applications and endpoints to ensure that they are not accessible
from the Internet unless they are designed for such exposure and the intended use requires such.

– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware
patches as well as anti-virus and firewall.

– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

More information on recommended practices can be found in the following documents:
- Defense in Depth for B&R products : https://www.br-automation.com/fileadmin/Cyber_Security_-_Defense_in_Depth_for_BR_Products-bdd37e82.pdf

General security recommendations

The information in this document is subject to change without notice, and should not be construed as a commitment by B&R.

B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or conse-quential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For additional instructions and support please contact your local B&R service organization. For contact information, see https://www.br-automation.com/en/about-us/locations/.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

B&R has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, B&R immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If B&R is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of B&R’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

What causes the vulnerability?
- The vulnerability is caused by insufficient validation mechanisms for server certificates in the ANSL over TLS and OPC-UA client implementations.

What is B&R Automation Studio?
- B&R Automation Studio is an environment for developing and executing automation solutions, ranging from control and motion technology to HMI, operation, and integrated safety technology.

What might an attacker use the vulnerability to do?
- An attacker who successfully exploited this vulnerability could spoof a trusted server, potentially leading to the disclosure of confidential information or the alteration of data during transit.

How could an attacker exploit the vulnerability?
- An attacker could attempt to exploit this vulnerability by generating a maliciously crafted server certificate and manipulating network routing or name resolution to redirect traffic through a compromised node under their control. This would require that the attacker has access to the system network, by connecting to the network either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or other-wise infects the network with malicious software. Recommended practices help mitigate such attacks, see section Miti-gating Factors above.

Could the vulnerability be exploited remotely?
- Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

What does the update do?
- The update removes the vulnerability by modifying the way that the ANSL and OPC-UA clients are validating server certificates.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- No, B&R discovered this vulnerability as a part of its own security analysis.

When this security advisory was issued, had B&R received any reports that this vulnerability was being exploited?
- No, B&R had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued

Frequently Asked Questions

Summary: ABB CYBERSECURITY ADVISORY - PDF version

Summary: ABB CYBERSECURITY ADVISORY - CSAF version

Automation Studio Insufficient Server Certificate Validation

Summary: Initial Version

An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges.

CVE Description

Summary: NVD - CVE-2025-11043

The problem is corrected in the following product versions:

B&R Automation Studio version 6.5

B&R recommends that customers apply the update at earliest convenience.

The process to install updates is described in the user manual. The step to identify the installed product version is de-scribed in the user manual.

To exploit this vulnerability, an attacker would need to intercept and redirect the communication between B&R Automation Studio and the target server, as well as present manipulated certificates that pass validation checks. B&R recommends operating B&R Automation Studio within Level 2 of the ABB ICS Cyber Security Reference Architecture when connecting to Level 1 devices via ANSL over TLS or OPC-UA. Operating in this trusted environment reduces the risk of successful exploitation drastically.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

CVE-2025-11043


ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that resolves a vulnerability.

An attacker who successfully exploited this vulnerability could cause the product to stop.

Summary

Support

Notice

General security recommendations

Purpose

What causes the vulnerability?
- The vulnerability is caused by insufficient throttling and limiting mechanism in the ANSL Server used the B&R Automation Runtime.

What might an attacker use the vulnerability to do?
- An attacker who successfully exploited this vulnerability could cause the affected system node to stop.

How could an attacker exploit the vulnerability?
- An attacker could try to exploit the vulnerability by creating a specially crafted message and sending the message to an affected system node. This would require that the attacker has access to the system network, by connecting to the net-work either directly or through a wrongly configured or penetrated firewall, or that he installs malicious software on a system node or otherwise infects the network with malicious software. Recommended practices help mitigate such attacks, see section Mitigating Factors above.

Could the vulnerability be exploited remotely?
- Yes, an attacker who has network access to an affected system node could exploit this vulnerability. Recommended practices include that process control systems are physically protected, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed.

What does the update do?
- The update removes the vulnerability by limiting incoming network traffic that is handled by the ANSL server component.

When this security advisory was issued, had this vulnerability been publicly disclosed?
- No, B&R discovered this vulnerability as a part of its own security analysis.

When this security advisory was issued, had B&R received any reports that this vulnerability was being exploited?
- No, B&R had not received any information indicating that this vulnerability had been exploited when this security advisory was originally issued.

Frequently Asked Questions

B&R Automation Runtime Improper Handling of Flooding conditions on ANSL Server

Summary: Initial version.

An Allocation of Resources Without Limits or Throttling vulnerability in the ANSL-Server component of B&R Automation Runtime versions prior to 6.5 and prior to R4.93 could be exploited by an unauthenticated attacker on the net-work to win a race condition, resulting in permanent denial-of-service (DoS) conditions on affected devices.

CVE description

Summary: NVD - CVE-2025-11044

The problem is corrected in the following product versions:
- Automation Runtime 6 versions >= 6.5
- Automation Runtime 4 versions >= R4.93

B&R recommends that customers apply the update at earliest convenience.

The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

The vulnerability cannot be exploited on all devices or across all customer applications. Extensive investigations by B&R have determined that shorter cycle times in customer projects increase the likelihood of potential exploitation. For customers unable to transition to a patched version, adjusting their application configuration to longer cycle times may therefore be considered as a mitigating measure.

B&R Automation Runtime is designed to be operated on Level 1 of the ABB ICS Cyber Security Reference Architecture. Exploitation of the vulnerability from outside Level 1 would require an attacker to bypass the Control Network Firewall. Limiting the maximum data traffic and the maximum number of concurrent connections to the ANSL server of Automation Runtime on the Control Network Firewall, shall be considered to mitigate this vulnerability.

B&R further recommends, in alignment with its Defense in Depth for B&R Products guidelines, that customers:
- Test the maximum load capacity of their application under Automation Runtime before commissioning.
- Restrict the permitted data traffic to the device via the Control Network Firewall to no more than 80% of the measured peak traffic value.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

CVE-2025-11044


ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that replaces an outdated third-party component.

Although no successful exploitation was observed during testing of the affected B&R products, the identified vulnerabilities could present potential attack vectors that might enable unauthorized access, data exposure, or remote code execution.

Summary

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by B&R.

B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For any installation of software related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

– Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls and separate them from any general purpose network (e.g. office or home networks).

– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

– Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.

– Scan all data imported into your environment before use to detect potential malware infections.

– Minimize network exposure for all applications and endpoints to ensure that they are not accessible from the Internet unless they are designed for such exposure and the intended use requires such.

– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware patches as well as anti-virus and firewall.

– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

More information on recommended practices can be found in the following documents:

Defense in Depth for B&R products - https://www.br-automation.com/fileadmin/Cyber_Security_-_Defense_in_Depth_for_BR_Products-bdd37e82.pdf

General security recommendations

Purpose

B&R Automation Studio Update of SQLite version

Summary: Initial version.

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue.

CVE description

Summary: NVD - CVE-2025-6965

The problem is corrected in the following product versions:

B&R Automation Studio 6.5

B&R recommends that customers apply the update at earliest convenience.

The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

Refer to section “General security recommendations” for advice on how to keep your system secure.

CVE-2025-6965

An integer overflow vulnerability exists in SQLite's concat_ws() function that can lead to a massive heap buffer overflow. When triggered, the integer overflow results in a truncated size value being used for buffer allocation, while the original untruncated size is used for writing the resulting string, causing a heap buffer overflow of approximately 4GB.

CVE description

Summary: NVD - CVE-2025-3277

CVE-2025-3277

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow.

CVE description

Summary: NVD - CVE-2023-7104

CVE-2023-7104

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

CVE description

Summary: NVD - CVE-2022-35737

CVE-2022-35737

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

CVE description

Summary: NVD - CVE-2020-15358

CVE-2020-15358

CVE description

Summary: NVD - CVE-2020-13632

CVE-2020-13632

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

CVE description

Summary: NVD - CVE-2020-13631

CVE-2020-13631

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

CVE description

Summary: NVD - CVE-2020-13630

CVE-2020-13630

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

CVE description

Summary: NVD - CVE-2020-13435

CVE-2020-13435

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

CVE description

Summary: NVD - CVE-2020-13434

CVE-2020-13434

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

CVE description

Summary: NVD - CVE-2020-11656

CVE-2020-11656

Improper Check for Unusual or Exceptional Conditions

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

CVE description

Summary: NVD - CVE-2020-11655

CVE-2020-11655

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.

CVE description

Summary: NVD - CVE-2019-19646

CVE-2019-19646

alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.

CVE description

Summary: NVD - CVE-2019-19645

CVE-2019-19645

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

CVE description

Summary: NVD - CVE-2019-8457

CVE-2019-8457

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allow-ing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

CVE description

Summary: NVD - CVE-2018-20506

CVE-2018-20506

SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).

CVE description

Summary: NVD - CVE-2018-20505

CVE-2018-20505

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.

CVE description

Summary: NVD - CVE-2018-20346

CVE-2018-20346

In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.

CVE description

Summary: NVD - CVE-2018-8740

CVE-2018-8740

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mis-handles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly un-specified other impact.

CVE description

Summary: NVD - CVE-2017-10989

CVE-2017-10989

CVE description

Summary: NVD - CVE-2016-6153

CVE-2016-6153

SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.

CVE description

Summary: NVD - CVE-2015-6607

CVE-2015-6607

Exposure of Sensitive Information to an Unauthorized Actor

Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown im-pact and attack vectors.

CVE description

Summary: NVD - CVE-2015-5895

CVE-2015-5895

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via un-specified vectors.

CVE description

Summary: NVD - CVE-2015-3717

CVE-2015-3717

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

CVE description

Summary: NVD - CVE-2015-3416

CVE-2015-3416


ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is now available that addresses and remediates the vulnerability.

An attacker who successfully exploited this vulnerability could read sensitive information in the logging data of the PVI client application. Logging is deactivated by default in all PVI client versions.

Summary

For additional instructions and support please contact your local B&R service organization. For contact information, see https://www.br-automation.com/en/about-us/locations/.

Information about ABB’s cyber security program and capabilities can be found at www.abb.com/cybersecurity.

Support

The information in this document is subject to change without notice, and should not be construed as a commitment by B&R.

B&R provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall B&R or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if B&R or its suppliers have been advised of the possibility of such damages.

This document and parts hereof must not be reproduced or copied without written permission from B&R, and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose.

All rights to registrations and trademarks reside with their respective owners.

Notice

For any installation of software related ABB products we strongly recommend the following (non-exhaustive) list of cyber security practices:

– Isolate special purpose networks (e.g. for automation systems) and remote devices behind firewalls
and separate them from any general-purpose network (e.g. office or home networks).

– Install physical controls so no unauthorized personnel can access your devices, components, peripheral equipment, and networks.

– Never connect programming software or computers containing programing software to any network other than the network for the devices that it is intended for.

– Scan all data imported into your environment before use to detect potential malware infections.

– Minimize network exposure for all applications and endpoints to ensure that they are not accessible
from the Internet unless they are designed for such exposure and the intended use requires such.

– Ensure all nodes are always up to date in terms of installed software, operating system, and firmware
patches as well as anti-virus and firewall.

– When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

More information on recommended practices can be found in the following documents:
- Defense in Depth for B&R products : https://www.br-automation.com/fileadmin/Cyber_Security_-_Defense_in_Depth_for_BR_Products-bdd37e82.pdf

General security recommendations

B&R has a rigorous internal cyber security continuous improvement process which involves regular testing with industry leading tools and periodic assessments to identify potential product issues. Occasionally an issue is determined to be a design or coding flaw with implications that may impact product cyber security.

When a potential product vulnerability is identified or reported, B&R immediately initiates our vulnerability handling process. This entails validating if the issue is in fact a product issue, identifying root causes, determining what related products may be impacted, developing a remediation, and notifying end users and governmental organizations.

The resulting Cyber Security Advisory intends to notify customers of the vulnerability and provide details on which products are impacted, how to mitigate the vulnerability or explain workarounds that minimize the potential risk as much as possible. The release of a Cyber Security Advisory should not be misconstrued as an affirmation or indication of an active threat or ongoing campaign targeting the products mentioned here. If B&R is aware of any specific threats, it will be clearly mentioned in the communication.

The publication of this Cyber Security Advisory is an example of B&R’s commitment to the user community in support of this critical topic. Responsible disclosure is an important element in the chain of trust we work to maintain with our many customers. The release of an Advisory provides timely information which is essential to help ensure our customers are fully informed.

Purpose

PVI Insertion of Sensitive Information into Logfile

Summary: Initial version.

An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential information which is processed by the PVI client application. The logging function of the PVI client application is disabled by default and must be explicitly enabled by the user.

CVE description

Summary: NVD - CVE-2026-0936

The problem is corrected in the following product versions:
- PVI 6.5.0

Please note that PVI is included in the Automation Studio installation package and shares the same version number as the corresponding Automation Studio release.

B&R recommends that customers apply the update at earliest convenience.

The process to install updates is described in the user manual. The step to identify the installed product version is described in the user manual.

This vulnerability is limited to the PVI client side application logging and does not impact any security related logging of the PVI server component. Logging is not enabled by default for PVI client applications. Activate logging on the client system only when it is required for troubleshooting, debugging or analysis. Ensure that all client side logging information is securely deleted after it is no longer needed.

When enabling logging in PVI client applications, the storage path for the log files must be specified. Make sure that only the respective user has access to the directories where the logging information is stored.

Refer to section “General security recommendations” for further advise on how to keep your system secure.

CVE-2026-0936