Attack Chain

1. Attacker gains local access to an ABB Advant Master Online Builder system node.
2. Attacker identifies an application directory with insufficient permission restrictions that is used by the vulnerable ABB software.
3. Attacker crafts a malicious Dynamic Link Library (DLL) designed to achieve their objective.
4. Attacker places the malicious DLL into the identified unrestricted application directory on the target system.
5. The legitimate ABB Advant Master Online Builder application is launched or attempts to load a required DLL.
6. Due to the uncontrolled search path element, the application loads the attacker's malicious DLL instead of the legitimate one.
7. The malicious DLL executes with the privileges of the affected application, enabling unauthorized code execution and compromising system integrity.

Impact

If successfully exploited, this vulnerability allows for unauthorized code execution and compromise of system integrity on the affected ABB Advant Master Online Builder system node. While CISA states that no exploitation was observed at the time of the advisory, the vulnerability could be leveraged to gain further control over industrial control systems. The affected products are widely deployed in Critical Manufacturing sectors worldwide, making successful exploitation a significant risk to operational technology environments.

Recommendation

• Patch CVE-2025-13162 immediately by updating ABB Control Builder A to version 1.4/5 or later.
• Patch CVE-2025-13162 immediately by updating ABB 800xA for Advant Master to version 6.1.1-5 or 6.2.0-3 or later.
• Implement recommended mitigation strategies by ABB to restrict temporary connections of portable devices and enforce strong password policies for users with system access, as detailed in the ABB advisory.
• Minimize network exposure for all control system devices, ensuring they are not internet-accessible, and isolate control system networks behind firewalls as recommended by CISA.