# Critical ABB Automation Runtime Flaw Exposes Industrial Control Systems to Unauthenticated Network Attacks
## The Threat
ABB has released a critical security update addressing a severe vulnerability in its Automation Runtime platform that could allow attackers to remotely disrupt operations at industrial facilities worldwide. The flaw, tracked as CVE-2025-3450, resides in the System Diagnostics Manager (SDM)—a diagnostic and maintenance component—and carries a maximum CVSS severity score of 10, indicating critical risk.
The vulnerability stems from improper resource locking in the SDM component, a weakness that permits unauthenticated attackers on the network to delete critical system data and trigger denial-of-service conditions. Because the attack requires no authentication, no user interaction, and operates over standard network protocols with low complexity, the barrier to exploitation is exceptionally low. An attacker with network access to an affected Automation Runtime system can crash the platform entirely, halting production processes, disrupting control loops, or rendering safety-critical systems inoperable.
This affects a broad installed base. ABB's Automation Runtime powers control systems across chemical plants, energy infrastructure, water treatment facilities, healthcare systems, communications networks, and critical manufacturing environments—entire sectors that depend on continuous operation. The company reports worldwide deployment, meaning the threat landscape spans multiple continents and regulatory jurisdictions.
## Severity and Impact
| Metric | Details |
|--------|---------|
| CVE | CVE-2025-3450 |
| CVSS v3.1 Base Score | 10.0 (CRITICAL) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H/E:U/RL:O/RC:C |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Changed |
| Confidentiality Impact | None |
| Integrity Impact | High |
| Availability Impact | High |
| CWE | CWE-413 (Improper Resource Locking) |
| Affected Sectors | Chemical, Communications, Critical Manufacturing, Dams, Energy, Healthcare & Public Health, Information Technology, Water & Wastewater |
## Affected Products
- Versions before 6.3
- Versions before Q4.93
The vulnerability affects both the standard release stream (6.x) and the quality/maintenance stream (Q-series versions). B&R recommends upgrading all affected instances to patched versions 6.3 or Q4.93 respectively.
## Mitigations
Immediate actions:
1. Apply patches urgently. Update to Automation Runtime 6.3 or Q4.93 at the earliest opportunity. B&R has published patched versions that resolve the underlying resource-locking vulnerability.
2. Disable SDM if not required. The System Diagnostics Manager is disabled by default in Automation Runtime 6 and later. If your systems are running older versions, disable SDM entirely through the Automation Studio project configuration unless active diagnostics are essential. Consult the B&R documentation (GUID: 1d915d67-07f7-4034-a472-c204b5cabbfe) for deactivation procedures.
3. Restrict SDM access. If SDM must remain enabled for maintenance, implement strict access controls. Limit SDM enablement to minimum timeframes required for authorized maintenance, and restrict access to trusted personnel through external security measures such as network segmentation and firewall rules.
4. Network segmentation. B&R emphasizes that SDM should never be exposed on untrusted networks or in facilities lacking adequate physical and logical access controls. Place affected systems behind segmented networks, restrict inbound connections to authorized administrative subnets, and monitor for unauthorized access attempts.
5. Audit your infrastructure. Inventory all Automation Runtime deployments and confirm installed versions. Prioritize updating systems in critical, production-facing environments—particularly those controlling energy, water, chemical, or healthcare operations.
## References
---
## HackWire Analysis
What makes this vulnerability particularly alarming is not just its perfect CVSS score, but the operational environment in which it exists. The System Diagnostics Manager was designed as a maintenance tool—something operators enable temporarily to diagnose problems, then disable. Yet this advisory reveals a dangerous pattern in industrial software: components marked "disabled by default" often persist on systems because operators don't know they're enabled, don't understand the security implications, or face business pressure to maintain system access for rapid troubleshooting.
The fact that SDM carries network-accessible, unauthenticated risk contradicts industrial control system security best practices. These systems should demand authentication, encryption, and air-gapping for any diagnostic access. Instead, an attacker who can reach an Automation Runtime system on the network—whether through direct exposure, lateral movement, VPN compromise, or supply chain access—can remotely delete data and crash operations without uttering a single credential.
The scope amplifies the concern. ABB's Automation Runtime runs across chemical plants, power grids, water treatment facilities, and healthcare infrastructure. A coordinated campaign exploiting this vulnerability could disrupt multiple critical sectors simultaneously. The window between disclosure and widespread patching—historically 30–60 days in industrial environments—means defenders face genuine pressure.
Organizations must move beyond assuming SDM is "disabled by default" and verify it. Patch immediately on systems exposed to any untrusted network, then verify the patch deployed successfully. Those unable to patch immediately should implement aggressive network segmentation, assuming SDM is compromised and acting accordingly. This is exactly the kind of flaw that spawns industrial incidents if left unaddressed. — *HackWire Editorial*
## Related Coverage