CVE-2025-3449 & CVE-2025-11498: ABB B&R Automation Runtime Vulnerabilities — Defense Guide

---
title: Potential ABB Automation Runtime XSS Injection Attempt
id: 9a1b2c3d-4e5f-6789-0123-456789abcdef
status: experimental
description: Detects potential Cross-Site Scripting (XSS) attempts against ABB Automation Runtime web interfaces via URI parameters.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-04
author: Security Arsenal
date: 2025/02/26
tags:
  - attack.initial_access
  - attack.t1190
  - cve-2025-3448
logsource:
  category: webserver
  product: apache
  # Note: If running IIS or other web servers, add appropriate definitions
detection:
  selection_uri:
    c-uri|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  selection_context:
    c-uri|contains:
      - '/automation'
      - '/webvisu'
  condition: all of selection_*
falsepositives:
  - Legitimate testing by authorized personnel
level: high
---
title: CSV Injection Payload in HTTP Parameters
id: b2c3d4e5-6f78-9012-3456-7890abcdef12
status: experimental
description: Detects characters often used in CSV Injection attacks within HTTP POST parameters, which could target the CVE-2025-11498 vulnerability.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-04
author: Security Arsenal
date: 2025/02/26
tags:
  - attack.initial_access
  - attack.t1566.001
  - cve-2025-11498
logsource:
  category: proxy
  product: suricata
  # Can also apply to webserver or firewall logs
detection:
  selection:
    cs-method|contains:
      - 'POST'
    c-uri-query|re: '^[=+\-@].*(cmd|powershell|calc|hyperlink)'
  condition: selection
falsepositives:
  - Valid data exports starting with symbols (rare in OT contexts)
level: medium
---
title: Suspicious Process Spawn via Excel (CSV Injection)
id: c3d4e5f6-7g89-0123-4567-8901bcdef234
status: experimental
description: Detects Microsoft Excel spawning a shell, a common indicator of successful CSV Injection (CVE-2025-11498).
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2025/02/26
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\EXCEL.EXE'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\mshta.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate Excel macros used for automation
level: high

// Hunt for XSS patterns targeting ABB Automation interfaces
let CommonXSSPatterns = dynamic(["<script", "javascript:", "onerror=", "onload=", "fromcharcode"]);
CommonSecurityLog
| where DeviceVendor in ("ABB", "B&R") or RequestURL contains "/automation"
| where RequestMethod == "GET" or RequestMethod == "POST"
| where isnotempty(RequestURL)
| parse RequestURL with * "?" QueryString
| where QueryString has any (CommonXSSPatterns)
| project TimeGenerated, DeviceIP, SourceIP, RequestURL, QueryString, RequestMethod
| order by TimeGenerated desc

-- Hunt for Excel spawning child processes (CSV Injection Indicator)
SELECT Parent.ProcessName AS ParentProcess, 
       Process.Name AS ChildProcess,
       Process.Pid,
       Process.Cmdline,
       Process.StartTime
FROM process_events()
WHERE Parent.ProcessName =~ "EXCEL.EXE"
  AND ChildProcess IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
ORDER BY Process.StartTime DESC
LIMIT 50

# Hardening Script: Restrict ABB Automation Runtime Management Access
# Usage: Run on the Windows Machine hosting the Engineering Interface or as a Network Policy enforcement script.
# Note: Modify $AllowedSubnets and $Ports as per your specific architecture.

$AllowedSubnets = @("192.168.10.0/24", "10.0.0.5") # Define your Engineering VLANs/Hosts
$Ports = @(80, 443, 44818) # Common ABB Web/Service Ports
$RuleName = "Block_ABB_Runtime_Unauthorized_Access"

# Check if rule exists and remove to update
if (Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue) {
    Remove-NetFirewallRule -DisplayName $RuleName
}

# Create Block Rule for Public/Untrusted Networks (Default Deny)
New-NetFirewallRule -DisplayName $RuleName `
    -Direction Inbound `
    -Action Block `
    -Protocol TCP `
    -LocalPort $Ports `
    -Profile Any `
    -Description "Block unauthorized access to ABB Automation Runtime ports."

# Create Allow Rules for specific trusted subnets
foreach ($Subnet in $AllowedSubnets) {
    $AllowRuleName = "Allow_ABB_Runtime_$($Subnet.Replace('/','_'))"
    if (Get-NetFirewallRule -DisplayName $AllowRuleName -ErrorAction SilentlyContinue) {
        Remove-NetFirewallRule -DisplayName $AllowRuleName
    }
    
    New-NetFirewallRule -DisplayName $AllowRuleName `
        -Direction Inbound `
        -Action Allow `
        -Protocol TCP `
        -LocalPort $Ports `
        -RemoteAddress $Subnet `
        -Profile Any `
        -Description "Allow ABB Runtime management from trusted subnet $Subnet."
}

Write-Host "Firewall rules applied. Only $AllowedSubnets can access ports $($Ports -join ',')." -ForegroundColor Green