In brief · As of October 2026
A B&R plant consists of an X20 CPU or an Automation PC with Automation Runtime, X20/X90 modules on the X2X Link, POWERLINK devices (bus controllers, ACOPOS drives) and Power Panels. From the maintenance PC only CPU, Automation PCs and panels answer via OPC UA and SNMP; the X20 modules on the X2X Link and the POWERLINK devices are not seen by any standard scan. They get into the device list through the controller's System Diagnostics Manager (hardware tree with order number and firmware per module) or from the Automation Studio project. For matching, the Automation Runtime version per controller counts: B&R publishes via the CSAF feed of ABB PSIRT, 29 advisories, 10 new in 2026, without CPE or material number. B&R states that it creates SBOMs but does not hand them out; for the plant you do not need one.
What hangs on a B&R controller and what of it is visible on the network
The controller is an X20 CPU, an Automation PC or a Power Panel with Automation Runtime. Attached are X20 and X90 modules directly on the X2X Link (the local module bus), X20 bus controllers and ACOPOS drives via POWERLINK, plus panels and IPCs via Ethernet. POWERLINK is Ethernet-based but works with a managing node and a fixed cycle; a maintenance PC outside the POWERLINK network does not see the devices.
- Visible via IP from the maintenance PC: CPU, Automation PCs and Power Panels via OPC UA (ServerStatus/BuildInfo, Automation Runtime version) and, depending on configuration, SNMP; switches.
- Only via the controller: all X20/X90 modules on the X2X Link and all POWERLINK devices. The CPU knows their order number and firmware, the network does not.
- Only from the engineering: modules without firmware (simple I/O) and the mapp/APROL software versions, which are to be kept as software.
How X20 modules and POWERLINK devices get into the list: System Diagnostics Manager and Automation Studio
The System Diagnostics Manager (SDM) is the web diagnostics of Automation Runtime: it shows the controller's hardware tree with module type, order number, firmware and hardware revision per X20 module and per POWERLINK device. That is the view of what is running, and the route Werkspilot Scan uses for B&R. The Automation Studio project, by contrast, shows what was planned:
- Automation Studio project (
.apj): hardware configuration with module types and the firmware versions of the X20/X90 modules stored in the project. - System Diagnostics Manager (SDM, web diagnostics in Automation Runtime): hardware and software analysis of the target system with modules and versions – that is the view of what is running.
- Network: POWERLINK participants cannot be reached from the maintenance PC by standard scan; Automation PCs and Power Panels answer via OPC UA (ServerStatus/BuildInfo) and, depending on configuration, SNMP. More in the article on the network scan per control world.
How B&R publishes advisories and what matching runs on
The B&R advisory page offers an "RSS Feed" and a "ROLIE / CSAF feed" – both point to ABB PSIRT, which has carried publication since the acquisition. There is no provider of its own under br-automation.com; seven older CSAF files sit on the B&R page as individual downloads without an index. ABB is listed in the BSI's CSAF aggregator; B&R documents can be recognised by the ID pattern sa<yy>p<nnn>.
| Measurement (7 Oct 2026) | Result |
|---|
| Advisories on the B&R website | 29 (SA22P001 … SA26P012) |
| of which as CSAF in the ABB feed | 14 (all from 15 Jan 2025) |
| Published in 2026 | 10 |
| Published or updated in 2026 (feed) | 14 – all B&R documents were re-released on 14 May 2026 |
| Documents with CPE or PURL (all 74 ABB documents) | 0 |
Example SA25P005 (ANSL server): product tree "Automation Runtime <6.5" and ">=R4.93" – product name plus version range, no material number. Hardware advisories such as SA24P003 (PixieFail, "B&R PCs") name product families. In the numbering SA26P002 to SA26P008 are missing publicly; whether they are under TLP:AMBER or were not published is open.
Because the advisories carry neither CPE nor material numbers, the Automation Runtime version (for example R4.93 or 6.5) per controller is the actual key, supplemented by the device type for hardware and UEFI advisories. The X20 module list is secondary for matching, but belongs in the plant SBOM because firmware advisories for modules can arrive at any time.
With 10 new advisories in 2026, B&R now publishes regularly. Anyone who has not subscribed to the feed misses on average one per month – and the reporting deadline under the CRA runs from awareness, not from publication.
B&R states in its CRA statement that it creates SBOMs but does not hand them out; for the plant you do not need one, the AR version per controller is enough.
What this means for installations with B&R components
- Record the Automation Runtime version and the device type per B&R controller; that is the column through which 14 of 14 CSAF documents are matched.
- Take the X20/X90 modules from the project or SDM with type and firmware – POWERLINK does not deliver them to an external scan.
- Carry APROL and mapp components as software, not as devices.
Ten new advisories in nine months, and the module list is neither on the network nor in the bill of materials with firmware, but only in the controller. In Werkspilot Scan, B&R is therefore stage 3: the run from the maintenance PC covers CPU, panels and IPCs via OPC UA and SNMP and, after enabling, the X20 and POWERLINK list via the controller's system diagnostics. We are currently trialling this stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.
