CVE-2025-11498
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-14

Assigner: Asea Brown Boveri Ltd. (ABB)

Description
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-14
Last Modified
2025-10-14
Generated
2026-06-16
AI Q&A
2025-10-14
EPSS Evaluated
2026-06-15
NVD
CVE-2025-11498
EUVD
EUVD-2025-34193
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
br_automation system_diagnostics_manager *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Neutralization of Formula Elements in a CSV file within the System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4. It allows a remote attacker to inject malicious formula data into a generated CSV file. To exploit this, the attacker must create a malicious link that a user clicks, and then the user must manually open the resulting CSV file, which contains the injected formula.

Impact Analysis

The vulnerability can lead to the execution of malicious formulas when the CSV file is opened, potentially allowing attackers to perform unauthorized actions such as data manipulation or code execution within the context of the user's environment. This can compromise data integrity and security.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11498. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart