An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened.

An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened.

An update is available that resolves a vulnerability identified by B&Rs internal security analysis in the product versions listed as affected in this advisory.

An attacker who successfully exploited these vulnerabilities could take over a remote session or execute code in the context of the user’s browser session.

An update is available that resolves a vulnerability identified by B&Rs internal security analysis in the product versions listed as affected in this advisory.

An attacker who successfully exploited these vulnerabilities could take over a remote session or execute code in the context of the user’s browser session.