CVE-2025-13162: ABB Control Builder A & 800xA Search Path Vulnerability

Technical summary

This vulnerability is classified as an Uncontrolled Search Path Element (CWE-427). The flaw allows a local attacker with low-level privileges to inject or redirect how the affected software searches for and loads files or libraries during execution. By controlling or predicting the search path, an attacker can force the application to load a malicious or modified library instead of the legitimate one, achieving arbitrary code execution or privilege escalation. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) reflects that exploitation requires local access, elevated complexity, low privileges, and user interaction; the impact is high integrity loss with no confidentiality or availability impact in the base metrics.

Business impact

For organizations running ABB's industrial control systems, this vulnerability poses a risk to integrity and uptime. A compromised operator or maintenance user could trigger unintended system behavior, potentially affecting process control, data integrity, or triggering false diagnostics. The localized and low-privilege nature of the attack means the risk is primarily from insider threats or compromised local accounts rather than remote mass exploitation. However, in critical process environments, even moderate-severity integrity issues warrant swift remediation to maintain operational confidence.

Affected systems

The vulnerability affects ABB Control Builder A versions through 1.4/4, and ABB 800xA for Advant Master versions through 6.0.3-1, through 6.1.1-1, 6.1.1-3, and 6.2.0-1. Organizations using these versions for process automation, monitoring, or configuration should verify their deployed versions immediately. Patched versions, if available, should be confirmed against official ABB security advisories.

Exploitability

Exploitation requires local system access and valid user credentials with at least basic privileges. Additionally, the attacker must influence a user to interact with the application in a specific way—for example, opening a project or triggering a library search. This multi-factor requirement (local access, low privilege, user interaction, high complexity) means opportunistic remote exploitation is not feasible. The threat is highest in environments where untrusted personnel have local machine access or where user accounts are shared or poorly managed.

Remediation

ABB has likely released patches for affected versions. Organizations should immediately check ABB's official security advisories and patch portal to identify fixed versions for Control Builder A and 800xA 6.0.x, 6.1.x, and 6.2.x lines. Prioritize production environments and systems that manage critical processes. Until patches are applied, mitigate by restricting local access, enforcing principle of least privilege for user accounts, and auditing file system permissions to limit search path manipulation opportunities.

Patch guidance

Contact ABB support or visit their security bulletin portal to obtain and verify patched versions for your specific Control Builder A and 800xA release. Test patches in a staging environment before deployment to ensure compatibility with custom configurations and add-ons. Document the patch date and version applied for compliance and audit trails. Verify that patch installation correctly updates the search path handling mechanism and does not introduce new dependencies or configuration changes that could disrupt your automation environment.

Detection guidance

Monitor for suspicious file system access patterns in the directories where Control Builder A and 800xA store libraries and configurations. Log all attempts to load libraries from unexpected locations using Windows Event Viewer (if applicable) or equivalent audit tools. Track user logon events and process creation, focusing on instances where Control Builder or 800xA child processes spawn from unusual parent processes or with unusual command lines. Use integrity monitoring tools to alert on unexpected changes to library files or search path configurations. Review application logs for unusual library loading failures or fallback behaviors that might indicate search path manipulation.

Why prioritize this

While the CVSS score of 4.4 (MEDIUM) reflects moderate risk, the industrial control context elevates concern. Process automation systems are often embedded in mission-critical workflows, and integrity compromise—even if not immediately visible—can erode trust in operational data. The requirement for local access and user interaction limits mass-exploitation risk but increases insider threat risk. Organizations should prioritize patching based on system criticality: tier-1 for systems directly controlling production, tier-2 for monitoring and supervisory systems, and tier-3 for non-production environments.

Risk score, explained

The CVSS 3.1 score of 4.4 reflects attack vector 'Local' (requires local system access), attack complexity 'High' (specialized conditions or user interaction needed), privileges required 'Low' (basic user account sufficient), and user interaction 'Required' (must involve an end user). The impact is isolated to integrity ('High'), with no confidentiality or availability impact at the base level. This scoring appropriately captures that the vulnerability is neither trivial nor critical—it poses a real risk to system integrity in a localized, targeted scenario rather than a widespread or easily exploited threat.

Frequently asked questions