CVE-2025-11498: B&r Industrial Automation GmbH Automation Runtime

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened.

Affected products

Published 2025-10-14. Last modified 2026-10-08.