CVE-2025-13162: ABB Control Builder A and 800xA uncontrolled search path element

CVE-2025-13162 · Severity: medium · CVSS 4.4 · Published 2026-06-23

ABB Control Builder A and 800xA for Advant Master, which are used to configure and manage industrial control systems, are vulnerable to a security flaw that could allow an attacker to execute unauthorized code. An attacker with local access to the system could trick a legitimate user into running a malicious file, potentially compromising the integrity of the industrial control environment. This could lead to unauthorized changes in system configurations or operational disruptions.

Vendors: ABB.

Quick answers

Is CVE-2025-13162 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-13162 being exploited in the wild.
How severe is CVE-2025-13162?
Medium severity, with a CVSS score of 4.4, published 23 June 2026.
Which products and versions are affected?
ABB 800xA for Advant Master through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1; ABB Control Builder A through 1.4/4.
Is there a fix for CVE-2025-13162?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13162 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-13162?
Check whether you run ABB 800xA for Advant Master or ABB Control Builder A at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uncontrolled search path element vulnerability (CWE-427) exists in ABB Control Builder A and 800xA for Advant Master. The vulnerability stems from the application searching for critical resources or libraries in directories that may be writable by a local user. An attacker with low privileges could place a malicious executable or library (such as a DLL) in the search path. Exploitation requires user interaction, typically involving a legitimate user executing the application while the malicious file is present in a high-priority search directory. Successful exploitation allows the attacker to execute code with the privileges of the application, potentially leading to unauthorized system modifications.

Affected products

  • ABB Control Builder A through 1.4/4
  • ABB 800xA for Advant Master through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1

Timeline

  • 2026-06-23: advisory: Initial advisory published by ABB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.