B&R Automation Runtime CVE-2025-11498

Exploitation targets the CSV export feature of the System Diagnostics Manager (SDM) in B&R Automation Runtime versions before 6.4. Concrete prerequisites: (1) the attacker must create and deliver a malicious link to a legitimate SDM user; (2) that user must click the link and trigger generation of a CSV file containing the attacker-controlled formula data; and (3) the user must then MANUALLY open the resulting CSV in a spreadsheet application that automatically evaluates formula cells. Limiting factors that reduce realistic risk: mandatory multi-step user interaction (a click plus a separate manual file-open), the fact that impact falls only on the user's workstation and not on the SDM/controller itself (VC:N/VI:N/VA:N), and dependence on the victim's spreadsheet software being configured to execute rather than sanitize formulas.

This is a medium-severity CSV formula injection flaw (CWE-1236) whose signals consistently point to LOW real-world urgency despite the network attack vector. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows no privileges required but PASSIVE user interaction (UI:P), and critically the only impacts are on the subsequent system (SC:L/SI:L) with zero impact to the vulnerable SDM system itself (VC:N/VI:N/VA:N) - meaning the vulnerability does not compromise the B&R Automation Runtime device, only potentially the workstation of a user who opens the generated file. EPSS is low at 0.31% (22nd percentile), there is no CISA KEV listing and no public exploit identified, so exploitation is neither probable nor observed. The multi-step precondition chain (attacker crafts a link, victim clicks it, then victim MUST manually open the resulting CSV in a spreadsheet application that honors formulas) makes reliable exploitation difficult. No SSVC decision data was supplied in the input. Net assessment: a legitimate but low-priority issue - real risk is throttled by heavy user interaction and the absence of any impact on the automation controller itself; patch during normal maintenance rather than emergency windows.

An attacker crafts a malicious link that, when visited by a user of the System Diagnostics Manager, injects spreadsheet formula payloads (e.g., =cmd| or =HYPERLINK) into a CSV export the user then generates. If that user manually opens the CSV in a spreadsheet application configured to execute formulas, the payload could run on the user's workstation, enabling data exfiltration or command execution on that host. No public exploit code is identified at time of analysis, and the attack requires both a click and a manual file-open step.