---
title: "Critical Vulnerabilities in ABB B&R Automation Studio Demand Immediate Update"
short_title: "ABB B&R Automation Studio critical flaws fixed"
description: "ABB patches 24 critical vulnerabilities in B&R Automation Studio, including RCE and memory corruption risks. Update to version 6.5 now to secure industrial systems."
author: "Vitus"
date: 2024-10-02
categories: [Cybersecurity, Vulnerabilities]
tags: [abb, industrial-security, cve, rce, memory-corruption]
score: 0.87
cve_ids: [CVE-2025-6965, CVE-2025-3277, CVE-2023-7104, CVE-2022-35737, CVE-2020-15358, CVE-2020-13632, CVE-2020-13631, CVE-2020-13630, CVE-2020-13435, CVE-2020-13434, CVE-2020-11656, CVE-2020-11655, CVE-2019-19646, CVE-2019-19645, CVE-2019-8457, CVE-2018-20506, CVE-2018-20505, CVE-2018-20346, CVE-2018-8740, CVE-2017-10989, CVE-2016-6153, CVE-2015-6607, CVE-2015-5895, CVE-2015-3717, CVE-2015-3416]
---
## TL;DR
ABB has released a critical update for B&R Automation Studio, addressing 24 vulnerabilities in versions prior to 6.5. These flaws, including remote code execution (RCE), heap-based buffer overflows, and memory corruption, could allow attackers to gain unauthorized access, expose sensitive data, or disrupt industrial operations. Users are urged to update to version 6.5 immediately to mitigate risks in energy and other critical infrastructure sectors.
Main Content
### Introduction
ABB, a global leader in industrial automation, has patched a series of critical vulnerabilities in its B&R Automation Studio software. The flaws, discovered in versions prior to 6.5, stem from an outdated third-party component and could expose industrial systems to unauthorized access, data breaches, and remote code execution (RCE). While no active exploitation has been observed, the severity of these vulnerabilities demands immediate action from organizations relying on this technology.
### Key Points
- 24 vulnerabilities patched in ABB B&R Automation Studio versions <6.5, including RCE, heap-based buffer overflows, and memory corruption.
- Highest CVSS score: 9.8 (Critical), with multiple flaws rated High or Medium severity.
- Affected sectors: Primarily energy, with global deployment across industrial environments.
- Mitigation: Update to version 6.5 and follow ABB’s general security recommendations.
- No known exploitation in the wild, but the potential for disruption or data exposure is significant.
### Technical Details
The vulnerabilities originate from an outdated version of SQLite, a widely used database engine integrated into B&R Automation Studio. The flaws include:
1. Memory Corruption Issues
- CVE-2025-6965: Numeric truncation error in SQLite versions before 3.50.2, leading to memory corruption.
- CVE-2020-13632: Similar truncation error causing memory corruption when aggregate terms exceed available columns.
2. Heap-Based Buffer Overflows
- CVE-2025-3277: Integer overflow in SQLite’s concat_ws() function, resulting in a 4GB heap buffer overflow.
- CVE-2023-7104: Critical flaw in SQLite3’s sessionReadRecord function, enabling heap-based buffer overflows.
- CVE-2019-8457: Out-of-bounds read in SQLite’s rtreenode() function, affecting versions 3.6.0 to 3.27.2.
3. Remote Code Execution (RCE) Risks
- CVE-2018-20506 and CVE-2018-20346: Integer overflows in SQLite’s FTS3 extension, allowing arbitrary code execution via crafted SQL statements.
- CVE-2015-3717: Buffer overflows in SQLite’s printf functionality, enabling RCE or denial-of-service (DoS).
4. Other Critical Flaws
- CVE-2020-13630: Use-after-free vulnerability in SQLite’s fts3EvalNextRow function.
- CVE-2020-11656: Use-after-free in SQLite’s ALTER TABLE implementation.
- CVE-2019-19645: Uncontrolled recursion in SQLite’s ALTER TABLE statements, leading to infinite loops.
### Impact Assessment
The vulnerabilities pose severe risks to industrial environments, particularly in the energy sector, where B&R Automation Studio is widely deployed. Potential impacts include:
- Unauthorized Access: Attackers could exploit flaws like CVE-2025-3277 or CVE-2019-8457 to gain control of industrial systems.
- Data Exposure: Vulnerabilities such as CVE-2015-5895 could expose sensitive information to unauthorized actors.
- Operational Disruption: Memory corruption and buffer overflow flaws could crash systems, leading to downtime or safety incidents.
- Remote Code Execution: Flaws like CVE-2018-20506 enable attackers to execute arbitrary code, potentially taking over entire systems.
### Mitigation Steps
ABB has released version 6.5 of B&R Automation Studio to address these vulnerabilities. Organizations are advised to:
1. Apply the Update Immediately
- Download and install B&R Automation Studio 6.5 from ABB’s official channels.
- Follow the user manual for installation and version identification guidance.
2. Follow General Security Recommendations
- Isolate industrial control systems (ICS) from business networks and the internet.
- Use firewalls and VPNs for secure remote access.
- Monitor systems for unusual activity and report incidents to CISA or ABB PSIRT.
3. Review CISA’s Recommended Practices
- Implement defense-in-depth strategies for ICS security.
- Refer to CISA’s ICS-TIP-12-146-01B for targeted cyber intrusion detection and mitigation strategies.
### Affected Systems
- Product: ABB B&R Automation Studio
- Affected Versions: All versions prior to 6.5
- Critical Infrastructure Sectors: Energy (primary), with global deployment.
- Vendor Headquarters: Switzerland
## Conclusion
The discovery of 24 critical vulnerabilities in ABB B&R Automation Studio underscores the urgent need for robust cybersecurity measures in industrial environments. While no active exploitation has been reported, the potential for remote code execution, data exposure, and operational disruption is significant. Organizations must update to version 6.5 immediately and adhere to security best practices to mitigate risks. Failure to act could leave critical infrastructure vulnerable to cyberattacks with far-reaching consequences.
## References
[^1]: ABB PSIRT. "ICS Advisory (ICSA-26-141-03)". Retrieved 2024-10-02.
[^2]: CISA. "Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies". Retrieved 2024-10-02.
[^3]: SQLite. "Security Advisories". Retrieved 2024-10-02.