B&R Automation Runtime Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the System Diagnostics Manager (SDM) component of B&R Automation Runtime. This issue affects versions 6.0 prior to 6.4. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of the user's browser session.

Impact

Exploitation of this vulnerability enables reflected cross-site scripting, allowing for the execution of malicious scripts in the user's browser session.

Reproduction

To reproduce this vulnerability, an attacker must create a hyperlink containing malicious script code. This hyperlink must then be opened by the user, triggering the execution of the embedded script.

Remediation

Users are advised to update to B&R Automation Runtime version 6.4 or later. For those using the System Diagnostic Manager, B&R recommends applying the update based on a risk assessment at the earliest convenience.