# ABB Advant Master Online Builder Vulnerable to Local Code Execution via Uncontrolled DLL Search Path


## The Threat


ABB has disclosed a critical vulnerability affecting its Advant Master Online Builder component that could allow attackers to execute arbitrary code on affected industrial control systems. The flaw, tracked as CVE-2025-13162, stems from improper handling of the DLL search path during application startup—a classic local exploitation vector that has plagued Windows applications for decades.


The vulnerability resides in how the Online Builder (ONB) component loads dynamic-link libraries. An attacker with local access to an affected system could place a malicious DLL in an untrusted directory that the application searches before legitimate system or application directories. When the application starts, it loads the attacker's malicious library instead of the legitimate one, granting the attacker code execution at the privilege level of the user running the application.


For industrial facilities relying on ABB's Advant Master platform—a widely deployed automation and control system in manufacturing, utilities, and critical infrastructure—this represents a significant risk. While the vulnerability requires local system access and user interaction to exploit, compromising an operator workstation or engineering system could allow lateral movement into the broader control network or manipulation of industrial processes.


## Severity and Impact


| Attribute | Details |

|-----------|---------|

| CVE ID | CVE-2025-13162 |

| CVSS v3.1 Base Score | 4.4 (MEDIUM) |

| Severity Rating | MEDIUM |

| Attack Vector | Local (AV:L) |

| Attack Complexity | High (AC:H) |

| Privileges Required | Low (PR:L) |

| User Interaction | Required (UI:R) |

| Scope | Unchanged (S:U) |

| Integrity Impact | High (I:H) |

| Confidentiality Impact | None (C:N) |

| Availability Impact | None (A:N) |

| CVSS Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N |

| CWE | CWE-427 (Uncontrolled Search Path Element) |


## Affected Products


ABB Control Builder A

  • Version 1.4/4 and earlier — vulnerable

    • ABB 800xA for Advant Master

  • Version 6.0.3-1 and earlier — vulnerable
  • Version 6.1.1-1 and earlier — vulnerable
  • Version 6.1.1-3 — vulnerable (vulnerability reintroduced)
  • Version 6.2.0-1 — vulnerable

    • Note on versioning: Version 6.1.1-2 does not contain this vulnerability. However, ABB reintroduced the flaw in version 6.1.1-3 when an older, vulnerable version of the Online Builder component was bundled in the release media—a supply-chain quality control issue that underscores the importance of rigorous component versioning practices.


    ## Mitigations


    Immediate Actions — Apply Security Updates


    ABB has released patched versions addressing CVE-2025-13162:


  • Control Builder A: Update to version 1.4/5 or later
  • 800xA for Advant Master (6.0.x/6.1.x line): Update to version 6.1.1-5 or later
  • 800xA for Advant Master (6.2.x line): Update to version 6.2.0-3 or later

    • If Immediate Patching Is Not Possible


    Until systems can be patched, ABB recommends implementing compensating controls:


  • Access Control: Enforce strict user access management. Allow only authorized personnel to log on to affected systems, and require strong passwords changed regularly.
  • Physical Security: Restrict the temporary connection of portable computers, USB memory devices, and other removable media to engineering or operator workstations running Advant Master.
  • Device Port Management: Disable USB and external ports on systems that can be physically accessed by regular users, or restrict them to only approved device types.
  • Network Segmentation: Isolate engineering networks from general IT infrastructure to limit attacker reach in case of compromise.

    • Organizations unable to patch or implement these controls should contact ABB Support for additional guidance and alternative remediation strategies.


    ## References


  • [ABB Security Advisory — CVE-2025-13162](https://www.abb.com/en/news/press-releases)
  • [CISA Vulnerability Notice](https://www.cisa.gov/)
  • [NVD — CVE-2025-13162](https://nvd.nist.gov/vuln/detail/CVE-2025-13162)
  • [CWE-427: Uncontrolled Search Path Element](https://cwe.mitre.org/data/definitions/427.html)

    • ---


    ## HackWire Analysis


    The Advant Master vulnerability highlights a persistent problem in industrial software supply chains: the reintroduction of known vulnerabilities through component versioning errors. ABB's own timeline is telling—version 6.1.1-2 shipped clean, but six months later, version 6.1.1-3 repackaged an older, vulnerable Online Builder build, effectively regressing the entire product line. This isn't a zero-day; it's an execution failure that exposes a gap in release engineering practices.


    What makes this particularly concerning for critical infrastructure operators is the attack profile. Yes, exploitation requires local access—but in manufacturing and utility environments, "local access" is routine. Engineering contractors regularly connect laptops to control networks. Maintenance personnel walk into server rooms. Industrial facilities often prioritize operational continuity over air-gapping, meaning a compromised engineering workstation can pivot into the industrial network.


    The CVSS score of 4.4 downplays the real-world risk. While confidentiality isn't impacted, the integrity impact is rated "High"—meaning an attacker could silently modify process logic, alter sensor readings, or corrupt control system configurations. In a power grid, water treatment facility, or manufacturing plant, that's a significant threat vector.


    The targeting is also notable: ABB Advant Master is deployed globally across Fortune 500 companies in critical sectors. A determined adversary doesn't need a remote exploit when local supply-chain compromises, vendor maintenance access, or insider threats provide the initial foothold. This vulnerability turns that foothold into system compromise.


    For defenders: patch aggressively and audit your physical access controls. For ABB and similar vendors: treat component versioning as part of your secure SDLC, not an afterthought. — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)