CVE-2025-3449
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-07

Last updated on: 2025-10-08

Assigner: Asea Brown Boveri Ltd. (ABB)

Description
A Generation of Predictable Numbers or Identifiers vulnerability in the SDM component of B&R Automation Runtime versions before 6.4 may allow an unauthenticated network-based attacker to take over already established sessions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-07
Last Modified
2025-10-08
Generated
2026-06-16
AI Q&A
2025-10-07
EPSS Evaluated
2026-06-15
NVD
CVE-2025-3449
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
br_automation runtime *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-340 The product uses a scheme that generates numbers or identifiers that are more predictable than required.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves the generation of predictable numbers or identifiers in B&R Industrial Automation Automation Runtime versions from 6.0 before 6.4. Predictable numbers or identifiers can be exploited by attackers to guess or predict values that should be random or unique, potentially leading to security issues.

Impact Analysis

The impact of this vulnerability is limited but could allow an attacker to predict identifiers or numbers generated by the affected Automation Runtime, which might lead to unauthorized actions or information disclosure. The CVSS scores indicate a low to medium severity with limited confidentiality and integrity impact and no availability impact.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-3449. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart