CVE-2025-11498 — CSV Formula Injection Vulnerability
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a re…
Published: 2025-10-14 · CVSS: 5.3 · CVSS 4.0
An Improper Neutralization of Formula Elements in a CSV File vulnerability exists in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 enabling a remote attacker to inject formula data into a generated CSV file. The exploitation of this vulnerability requires the attacker to create a malicious link. The user would need to click on this link, after which the resulting CSV file addi-tionally needs to be manually opened.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7