CVE-2025-11498
CSV Formula Injection Vulnerability
Description
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened.
INFO
Published Date :
Oct. 14, 2025, 1:15 p.m.
Last Modified :
Oct. 8, 2026, 12:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | 2b718523-d88f-4f37-9bbd-300c20644bf9 | ||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | MEDIUM | 2b718523-d88f-4f37-9bbd-300c20644bf9 | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update Automation Runtime to version 6.4 or later.
- Avoid opening untrusted CSV files.
- Sanitize all user-supplied input used in CSV generation.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-11498.
| URL | Resource |
|---|---|
| https://www.br-automation.com/fileadmin/SA25P003-178b6a20.pdf |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-11498 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-11498
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-11498 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-11498 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 08, 2026
Action Type Old Value New Value Changed Translation Title: Automation Runtime de B&R Industrial Automation GmbH, Description: Una vulnerabilidad de Neutralización Incorrecta de Elementos de Fórmula en un Archivo CSV existe en System Diagnostics Manager (SDM) de las versiones de B&R Automation Runtime anteriores a la 6.4, permitiendo a un atacante remoto inyectar datos de fórmula en un archivo CSV generado. La explotación de esta vulnerabilidad requiere que el atacante cree un enlace malicioso. El usuario necesitaría hacer clic en este enlace, después de lo cual el archivo CSV resultante adicionalmente necesita ser abierto manualmente. Title: Automation Runtime de B&R Industrial Automation GmbH, Description: Una vulnerabilidad de Neutralización Incorrecta de Elementos de Fórmula en un Archivo CSV existe en System Diagnostics Manager (SDM) de las versiones de B&R Automation Runtime anteriores a la 6.4, permitiendo a un atacante remoto inyectar datos de fórmula en un archivo CSV generado. La explotación de esta vulnerabilidad requiere que el atacante cree un enlace malicioso. El usuario necesitaría hacer clic en este enlace, después de lo cual el archivo CSV resultante adicionalmente necesita ser abierto manualmente. -
CVE Translated by [email protected]
Oct. 08, 2026
Action Type Old Value New Value Added Translation Title: Automation Runtime de B&R Industrial Automation GmbH, Description: Una vulnerabilidad de Neutralización Incorrecta de Elementos de Fórmula en un Archivo CSV existe en System Diagnostics Manager (SDM) de las versiones de B&R Automation Runtime anteriores a la 6.4, permitiendo a un atacante remoto inyectar datos de fórmula en un archivo CSV generado. La explotación de esta vulnerabilidad requiere que el atacante cree un enlace malicioso. El usuario necesitaría hacer clic en este enlace, después de lo cual el archivo CSV resultante adicionalmente necesita ser abierto manualmente. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'B&R Industrial Automation GmbH', 'product': 'Automation Runtime', 'versions': [{'status': 'affected', 'version': '6.0', 'lessThan': '6.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-11498', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-10-14T15:31:29.889194Z'} -
New CVE Received by [email protected]
Oct. 14, 2025
Action Type Old Value New Value Added Description An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Added CWE CWE-1236 Added Reference https://www.br-automation.com/fileadmin/SA25P003-178b6a20.pdf