CVE-2025-13162: ABB Control Builder Path Traversal Flaw

CVE-2025-13162 Overview

CVE-2025-13162 is an Uncontrolled Search Path Element vulnerability [CWE-427] affecting ABB Control Builder A and ABB 800xA for Advant Master. The flaw allows a local authenticated attacker to influence the library or executable search order used by the affected industrial control software. Successful exploitation can lead to the loading of attacker-supplied code in the security context of the target application. The issue affects Control Builder A through 1.4/4 and 800xA for Advant Master through 6.0.3-1, 6.1.1-1, 6.1.1-3, and 6.2.0-1.

Critical Impact
A local attacker with low privileges can hijack the search path used by ABB engineering and control software, leading to integrity compromise of process control workstations.

Affected Products

ABB Control Builder A through version 1.4/4
ABB 800xA for Advant Master through 6.0.3-1, 6.1.1-1, 6.1.1-3
ABB 800xA for Advant Master through 6.2.0-1

Discovery Timeline

2026-06-23 - CVE-2025-13162 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2025-13162

Vulnerability Analysis

The vulnerability stems from how the affected ABB products resolve external resources during process startup and runtime. The software relies on a search path that is not fully controlled by the application, allowing attacker-supplied files placed in writable locations earlier in the path to be loaded instead of the legitimate components. Exploitation requires local access and some user interaction, which limits remote attack scenarios but remains relevant for engineering workstations and operator stations in distributed control system environments. A successful attack does not impact confidentiality or availability directly but yields high integrity impact, enabling code execution under the application's identity.

Root Cause

The root cause is improper validation of the search path used to locate executables, libraries, or supporting modules. Classified as [CWE-427] Uncontrolled Search Path Element, the affected components do not enforce fully qualified paths or restrict directories used during resource resolution. When a writable directory appears in the lookup order, a local user can stage a malicious binary that the trusted application loads at startup.

Attack Vector

The attack vector is local. An authenticated user with the ability to write to a directory referenced by the affected application's search path stages a crafted dynamic library or executable. When an operator or service starts the ABB Control Builder A or 800xA for Advant Master component, the planted artifact loads in place of the legitimate file. The high attack complexity reflects environmental conditions that must align for exploitation to succeed.

No public proof-of-concept or exploit code is available. Refer to the ABB security advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-13162

Indicators of Compromise

Unexpected DLL, EXE, or shared library files appearing in directories referenced by ABB Control Builder A or 800xA for Advant Master installations.
Loaded module lists for ABB processes that reference binaries outside the installation directory or vendor-signed paths.
File creation events in user-writable directories that precede legitimate ABB application paths in PATH or library search order.

Detection Strategies

Inventory the effective search path for affected ABB processes and flag any writable directories that are evaluated before the install path.
Hunt for image loads originating from non-vendor directories within Control Builder A and 800xA parent processes.
Correlate file write events in directories on the application search path with subsequent ABB process launches.

Monitoring Recommendations

Enable image-load and process-creation telemetry on engineering workstations and operator stations running ABB software.
Track changes to environment variables such as PATH and to directory access control lists for ABB program directories.
Alert on the creation of unsigned binaries in directories adjacent to ABB executables.

How to Mitigate CVE-2025-13162

Immediate Actions Required

Restrict write permissions on all directories referenced by the search path used by ABB Control Builder A and 800xA for Advant Master.
Limit interactive logon and local account privileges on systems running affected ABB software to a minimal set of authorized engineers.
Review and remove unnecessary entries from the system and user PATH variables on affected hosts.

Patch Information

ABB has published guidance for affected versions of Control Builder A (through 1.4/4) and 800xA for Advant Master (through 6.0.3-1, 6.1.1-1, 6.1.1-3, and 6.2.0-1). Consult the ABB advisory document 7PAA020047 for fixed versions, mitigation packages, and deployment instructions. Apply vendor-supplied updates following the ABB recommended change management procedure for control system environments.

Workarounds

Enforce application allow-listing so only vendor-signed binaries can load within ABB process contexts.
Segment engineering and operator workstations on a dedicated control network with strict access control to limit local user reach.
Audit and harden NTFS or filesystem permissions on ABB installation and working directories to deny write access for standard users.

bash

# Configuration example: audit writable directories on the PATH (Windows PowerShell)
$env:PATH -split ';' | ForEach-Object {
    if (Test-Path $_) {
        $acl = Get-Acl $_
        [PSCustomObject]@{
            Path  = $_
            Owner = $acl.Owner
            Write = ($acl.Access | Where-Object { $_.FileSystemRights -match 'Write|Modify|FullControl' }).IdentityReference -join ';'
        }
    }
}