B&R Automation Runtime CVE-2025-3450
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SDM service over network
-
DeliverySend crafted unauthenticated requests
-
ExploitTrigger improper resource-locking flaw
-
ExecutionDelete runtime data
-
ImpactCause denial of service
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires network reachability to the SDM (service/data management) component of B&R Automation Runtime on versions before 6.3 and before Q4.93; per the CVSS 4.0 vector (PR:N/UI:N) no authentication, credentials, or user interaction are needed against a default deployment. The practical limiting factor is network exposure: B&R Automation Runtime runs on industrial controllers typically deployed on segmented OT/plant networks rather than the public internet, so exploitation depends on the attacker first reaching the SDM service. No non-default configuration is cited as a prerequisite in the description. |
| Impact | Signals are mixed and point to a high-severity but not yet widely-exploited OT flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction and high integrity/availability impact, consistent with the 9.3 CRITICAL score and the data-deletion DoS described. Counterbalancing this, the EPSS score is only 0.28% (19th percentile), there is no CISA KEV listing, and no public exploit was identified - so despite the critical CVSS, there is no evidence of real-world exploitation at time of analysis. The confidentiality impact is explicitly none (VC:N), confirming this is a destructive/availability issue rather than a data-theft vector. Net: this is a genuine priority for operators of affected B&R Automation Runtime versions because of the unauthenticated network vector and DoS impact on industrial systems, but the low EPSS and absence of KEV/POC suggest it is not under active or automated exploitation. Note: the input provides only a CVSS 4.0 vector (no 3.1 vector) and no SSVC decision data, so automatable/exploitation-status fields could not be cross-referenced. |
| Exploit ScenarioDerived | An attacker with network access to an exposed B&R Automation Runtime SDM service sends crafted requests that abuse an improper resource-locking (race) condition to delete data, crashing or corrupting the runtime and causing a denial of service on the industrial controller. No authentication or user interaction is required per the CVSS 4.0 vector (PR:N/UI:N). No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Unauthenticated remote attackers can delete data in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93, causing denial-of-service conditions through improper resource locking. The flaw is rated CVSS 9.3 with high integrity and availability impact but no confidentiality impact, and no public exploit has been identified at time of analysis (EPSS 0.28%, 19th percentile). Exposure is limited in practice to controllers reachable from the attacker’s network, typically OT/plant segments rather than the public internet.
RemediationAI
Vendor-released patch: upgrade B&R Automation Runtime to 6.3 or Q4.93 (or later) as documented in advisory SA25P002 (https://www.br-automation.com/fileadmin/SA25P002-f6a69e61.pdf). If immediate upgrade is not possible, reduce exposure by restricting network reachability to the SDM component-place controllers behind OT firewalls, allow only trusted engineering workstations to reach management services, and monitor for unexpected data deletion or service restarts. These compensating controls may disrupt legitimate remote engineering and data-management workflows, so validate access rules before enforcement; no public exploit code was identified at time of analysis, but the unauthenticated network vector makes perimeter/segmentation controls important until patching is complete.
Affected ProductsAI
B&R Automation Runtime versions before 6.3 and before Q4.93 are affected, specifically the SDM component exposed to the network. The vendor advisory (SA25P002, https://www.br-automation.com/fileadmin/SA25P002-f6a69e61.pdf) is the authoritative source for affected models and firmware mappings; no CPE identifiers were included in the available intelligence. Industrial controllers running these runtime versions are in scope if the SDM service is network-reachable.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
B&R Automation Runtime is the runtime/firmware environment for B&R industrial controllers, and the SDM component handles service/data management functions. CWE-413 (Improper Resource Locking) points to a failure to correctly serialize access to a shared resource, allowing a network-based attacker to invoke destructive operations without credentials or user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H) and independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H) agree that confidentiality is unaffected while integrity and availability are high; exploitation requires network reachability to the SDM service. No CPE data was provided, so version-based identification should follow the vendor advisory SA25P002.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Unauthenticated network attack with low complexity (PR:N/UI:N/AC:L); data deletion gives I:H and the resulting DoS gives A:H, with no confidentiality impact (C:N).
Primary rating from Vendor (ch).
CVSS VectorVendor: ch
DescriptionCVE.org
An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions.
Executive ViewAI
B&R Automation Runtime releases before 6.3 and before Q4.93 contain a critical SDM component flaw that can let remote attackers delete data and disrupt controller availability, affecting industrial operations that depend on those controllers. Because affected devices are typically reachable only inside OT/plant networks, leadership should focus on exposure management and segmentation while noting that no public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict network reachability to affected B&R Automation Runtime controllers and SDM interfaces, segment OT/plant networks, enforce allowlisted engineering access, maintain offline backups, and monitor for data deletion or denial-of-service activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB