Critical severity · published Oct 7, 2025
CVE-2025-3450
Automation Runtime SDM requests may impact system
10.0
CVSS
0.3%
EPSS
No
On KEV
Description
An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Automation Runtime · B&R Industrial Automation
6.0 before 6.3; 4.0 before Q4.93 · source: vendor
In the news
VulnerabilityCritical
ABB B&R Automation Runtime DoS Vulnerability in System Diagnostics Manager (SDM)
View CSAF Summary An update is available that resolves a vulnerability identified by B&Rs internal security analysis in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the product to stop. The following versions of ABB B&R Automation Runtime DoS Vulnerability in System Diagnostics Manager (SDM) are affected: Automation Runtime <6.3 Automation Runtime <Q4.93 CVSS Vendor Equipment Vulnerabilities v3 10 B&R ABB B&R Automation Runtime DoS Vulnerability in System Diagnostics Manager (SDM) Improper Resource Locking Background Critical Infrastructure Sectors: Chemical, Communications, Critical Manufacturing, Dams, Energy, Healthcare and Public Health, Information Technology, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: Switzerland Vulnerabilities Expand All + CVE-2025-3450 An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions. View CVE Details Affected Products ABB B&R Automation Runtime DoS Vulnerability in System Diagnostics Manager (SDM) Vendor: B&R Product Version: Automation Runtime <6.3, Automation Runtime <Q4.93 Product Statu...
May 26, 2026·CISA Advisories
Affected product
AR
Automation Runtime
B&R Industrial Automation
More from Automation Runtime
9.8
CVE-2024-0323
FTP uses unsecure encryption mechanisms
7.5
CVE-2024-8603
A “Use of a Broken or Risky Cryptographic Algorithm” vulnerability in the SSL/TLS component used in B&R Automation Runtime versions before 6.1 and B&R mapp View versions before…
7.5
CVE-2024-5800
Diffie-Hellman groups with insufficient strength used in SSL/TLS stack of B&R Automation Runtime
7.2
CVE-2024-2637
Insecure Loading of Code in B&R Products
6.1
CVE-2023-6028
SDM Web interface vulnerable to XSS