CVE-2025-11498: B&R Automation Runtime CSV Injection Flaw

CVE-2025-11498 Overview

CVE-2025-11498 is a CSV formula injection vulnerability in the System Diagnostics Manager (SDM) component of B&R Automation Runtime. The flaw affects all Automation Runtime versions before 6.4 and is tracked under [CWE-1236: Improper Neutralization of Formula Elements in a CSV File]. A remote attacker can inject formula data into CSV files generated by SDM. Exploitation requires user interaction: the victim must click a crafted link and then manually open the resulting CSV file in a spreadsheet application. The issue is documented in the B&R Automation Security Advisory SA25P003.

Critical Impact
Successful exploitation allows an attacker to execute spreadsheet formulas in the context of the user who opens the exported CSV file, potentially leading to limited confidentiality and integrity impact on the endpoint that processes the file.

Affected Products

B&R Automation Runtime versions before 6.4
System Diagnostics Manager (SDM) component
Industrial automation controllers running affected Automation Runtime releases

Discovery Timeline

2025-10-14 - CVE-2025-11498 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11498

Vulnerability Analysis

The System Diagnostics Manager exports diagnostic data to CSV files. SDM does not neutralize spreadsheet formula prefix characters such as =, +, -, @, tab, and carriage return before writing user-influenced fields into the CSV output. When a spreadsheet application such as Microsoft Excel or LibreOffice Calc opens the file, these fields are interpreted as formulas rather than plain text. An attacker who can influence field content through a crafted link can therefore embed formulas that execute on the victim's workstation. The attack chain is multi-step and depends on both link activation and manual opening of the exported CSV, which limits scalability but does not remove the risk in operator or engineering workstation environments.

Root Cause

The root cause is missing output encoding in the CSV generation routine of SDM. Fields sourced from attacker-controllable input parameters are written directly to the CSV stream without escaping leading formula trigger characters. The application treats the export as data serialization while spreadsheet clients interpret specific leading characters as executable expressions. This mismatch between producer and consumer semantics is the classic pattern described in [CWE-1236].

Attack Vector

An attacker crafts a URL targeting an SDM endpoint that reflects attacker-supplied values into an exported CSV file. The attacker delivers the link through phishing, chat, or another social channel. When the operator clicks the link and manually opens the downloaded CSV, the embedded formula executes. Payloads can include DDE, HYPERLINK, or WEBSERVICE style constructs that exfiltrate cell data, trigger outbound network requests, or invoke external programs depending on the spreadsheet application and its macro or DDE configuration.

Detection Methods for CVE-2025-11498

Indicators of Compromise

CSV files exported from SDM containing cell values that begin with =, +, -, or @
HTTP requests to SDM endpoints with query parameters containing formula prefix characters or spreadsheet function names such as HYPERLINK, WEBSERVICE, or DDE
Spreadsheet processes spawning child processes such as cmd.exe, powershell.exe, or outbound network connections shortly after opening an SDM-exported CSV

Detection Strategies

Inspect web proxy and application logs for SDM URLs where input parameters contain leading =, +, -, @, tab, or carriage return characters
Alert on Excel or Calc processes initiating outbound connections or launching command interpreters, which indicates formula-triggered code execution
Perform content inspection on CSV files generated by industrial engineering tools and flag cells starting with formula trigger characters

Monitoring Recommendations

Monitor engineering and operator workstations for spreadsheet applications loading files from browser download directories tied to SDM sessions
Track outbound DNS and HTTP traffic from Office applications to non-corporate destinations
Correlate SDM export activity with subsequent spreadsheet execution events on the same host

How to Mitigate CVE-2025-11498

Immediate Actions Required

Upgrade B&R Automation Runtime to version 6.4 or later on all controllers running SDM
Instruct operators not to open CSV files delivered through unsolicited links, even when the source appears to be an internal SDM instance
Restrict network access to SDM interfaces so that only authenticated engineering hosts on trusted network segments can reach the service

Patch Information

B&R has addressed the vulnerability in Automation Runtime version 6.4. Refer to the B&R Automation Security Advisory SA25P003 for exact fixed builds and upgrade guidance for each product line.

Workarounds

Configure Microsoft Excel and LibreOffice Calc to disable Dynamic Data Exchange (DDE) and to block automatic execution of external content
Open exported CSV files in a plain text editor to review contents before loading them into a spreadsheet application
Apply Group Policy or endpoint configuration to disable WEBSERVICE, HYPERLINK auto-activation, and macro execution for files sourced from the internet zone

bash

# Configuration example: disable DDE in Excel via registry on Windows engineering workstations
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v DisableDDEServerLaunch /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v DisableDDEServerLookup /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f