CVE-2025-11482: Detecting and Mitigating B&R PPT30 OPC-UA DoS

Introduction

For organizations managing Operational Technology (OT) and Industrial Control Systems (ICS), availability is often the paramount security objective. A new advisory (ICSA-26-155-03) from CISA highlights a critical threat to availability in CVE-2025-11482, affecting the B&R PPT30 Operating System.

B&R Industrial Automation’s PPT30 OS is a component widely deployed in Commercial Facilities, Critical Manufacturing, Energy, and Transportation Systems. This vulnerability, rated CVSS v3 7.5 (High), stems from an "Allocation of Resources Without Limits or Throttling" (CWE-770). If successfully exploited, an attacker can render the device's OPC-UA server inaccessible, causing a denial-of-service (DoS) condition that can sever communication between HMIs and controllers.

Given the prevalence of OPC-UA in modern industrial architectures, this vulnerability requires immediate attention to prevent operational disruption.

Technical Analysis

Vulnerability Mechanics

CVE-2025-11482 is a resource exhaustion vulnerability. The affected PPT30 Operating System fails to properly throttle or limit the allocation of system resources (such as memory or connection handles) when processing specific requests via the OPC-UA server.

Attack Vector: An attacker can send maliciously crafted requests—likely a high volume of specific service calls or malformed packets—to the targeted device.
Impact: The system consumes available resources until it can no longer sustain the OPC-UA server process, resulting in a crash or a hang. The device may remain powered on, but critical data communication stops.
Complexity: Resource exhaustion attacks often require little sophistication to execute, especially if the request triggering the leak is simple to replay.

Affected Products

Manufacturer: B&R Industrial Automation GmbH
Product: B&R PPT30 Operating System
Affected Versions:
- PPT30 Operating System < 1.8.0
- PPT30 Operating System 1.8.0

Note: This implies all versions up to and including 1.8.0 are vulnerable. Organizations must update to a version newer than 1.8.0 to mitigate this specific issue.

Exploitation Status

As of the advisory release, the vulnerability is disclosed with a CSAF (Common Security Advisory Framework) notice. While active exploitation in the wild has not been explicitly confirmed in this advisory, the ubiquity of OPC-UA and the accessibility of the attack vector (often network-facing) make it a high-value target for availability-focused attacks, particularly for threat actors looking to disrupt industrial processes.

Detection & Response

Detecting this vulnerability requires a two-pronged approach: monitoring for the network behavior indicative of a DoS attempt and monitoring for the system outcome (service crashes).

Since the B&R PPT30 is an embedded industrial controller, we rely heavily on network telemetry (NetFlow, Zeek, or Firewall logs) and Syslog/CEF ingestion into the SOC.

SIGMA Rules

The following rules focus on detecting potential OPC-UA flooding behavior and log signatures indicating a resource crash.

YAML

---
title: Potential OPC-UA Denial of Service Flood
id: 8b4d1a2f-3c6e-4f5b-9a2d-1e3f5a7b9c0d
status: experimental
description: Detects a high volume of traffic to OPC-UA standard port 4840, potentially indicating a resource exhaustion attempt against an ICS target.
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11482
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-03
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
defender:
  impact: high
logsource:
  category: network
  product: firewalld
detection:
  selection:
    DestinationPort: 4840
    Protocol: tcp
  condition: selection | count() > 5000
timeframe: 60s
falsepositives:
  - Legitimate high-throughput polling during normal operations (unlikely to be this high)
level: high
---
title: B&R PPT30 Resource Exhaustion System Log
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects log entries indicative of resource exhaustion or process termination on B&R industrial controllers ingested via Syslog/CEF.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-03
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: linux
  service: syslog
detection:
  keywords:
    Message|contains:
      - 'Resource limit exceeded'
      - 'Out of memory'
      - 'OPC-UA'
      - 'Ppt30'
  selection:
    Message|contains: 'stopped' 
  condition: keywords and selection
falsepositives:
  - System restarts or scheduled maintenance windows
level: medium

KQL (Microsoft Sentinel / Defender)

Use this query to hunt for spikes in traffic to your known B&R PPT30 endpoints or any endpoint listening on the OPC-UA port.

KQL — Microsoft Sentinel / Defender

// Hunt for spikes in OPC-UA traffic (Port 4840) potentially indicating DoS
let TimeRange = 1h;
let Threshold = 10000; // Adjust based on baseline traffic
DeviceNetworkEvents
| where Timestamp > ago(TimeRange)
| where RemotePort == 4840 or LocalPort == 4840
| summarize PacketCount = sum(SentBytes + ReceivedBytes), ConnectionCount = count() by DeviceName, bin(Timestamp, 5m)
| where ConnectionCount > Threshold or PacketCount > 100000000 // 100MB threshold
| project Timestamp, DeviceName, ConnectionCount, PacketCount
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for established network connections on Linux-based gateways or the controllers themselves (if Velociraptor is deployed) to identify potential saturation of the OPC-UA port.

VQL — Velociraptor

-- Hunt for abnormal number of connections on OPC-UA port
SELECT count() as ConnectionCount, RemoteAddress
FROM netstat()
WHERE State = 'ESTABLISHED'
  AND (RemotePort = 4840 OR LocalPort = 4840)
GROUP BY RemoteAddress
HAVING ConnectionCount > 100
ORDER BY ConnectionCount DESC

Remediation Script (Bash)

Context: Use this script on a management Linux server or jump host to verify connectivity and service status of your B&R PPT30 devices. This serves as a validation step post-patching to ensure the OPC-UA service is responsive.

Bash / Shell

#!/bin/bash

# B&R PPT30 OPC-UA Health Check
# Verifies connectivity to the OPC-UA server (Port 4840)

TARGET_IP=$1
TIMEOUT=5

if [ -z "$TARGET_IP" ]; then
  echo "Usage: $0 <TARGET_IP>"
  exit 1
fi

echo "[+] Checking OPC-UA connectivity for $TARGET_IP on port 4840..."

# Check if port 4840 is open and responsive using timeout and nc (netcat)
if timeout $TIMEOUT bash -c "cat < /dev/null > /dev/tcp/$TARGET_IP/4840" 2>/dev/null; then
  echo "[SUCCESS] OPC-UA port 4840 is OPEN and responsive on $TARGET_IP."
  exit 0
else
  echo "[ALERT] OPC-UA port 4840 is CLOSED or unresponsive on $TARGET_IP. Potential DoS condition or device offline."
  exit 1
fi

Remediation

To effectively defend against CVE-2025-11482, Security Arsenal recommends the following immediate actions:

Patch Management:
- Review the inventory of all B&R PPT30 devices within your environment.
- Update the operating system to a version newer than 1.8.0. Consult the official B&R Industrial Automation advisory for the specific patched release version.
- Reference: B&R Industrial Automation Advisory
Network Segmentation:
- Ensure OPC-UA traffic (TCP 4840) is strictly limited. The PPT30 devices should only communicate with designated engineering workstations and HMIs.
- Block internet-facing access to port 4840 immediately. These devices should never be directly accessible from the public internet.
Intrusion Detection Systems (IDS):
- Deploy IDS signatures that detect anomalous flooding patterns on TCP port 4840.
- Monitor for sudden drops in OPC-UA session statistics, which may indicate a crash event.
CISA Recommendations:
- Review CISA Advisory ICSA-26-155-03 for specific mitigations if patching is not immediately possible (e.g., deep packet inspection to filter malformed OPC-UA requests).

Related Resources

Security Arsenal Alert Triage Automation AlertMonitor Platform Book a SOC Assessment platform Intel Hub