ABB Freelance Security Lock bypass via keyboard shortcuts

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A vulnerability in ABB Freelance Security Lock allows attackers with physical access to bypass security controls using undocumented keyboard combinations, affecting critical manufacturing systems worldwide.

Sourcecisa.gov — open the original

ABB has disclosed CVE-2025-7064, an authentication bypass vulnerability in the Freelance Security Lock feature across all versions from Freelance 2013 through Freelance 2024. The flaw allows an attacker with physical access to circumvent the Security Lock by using undocumented or special keyboard combinations available on modern keyboards. Once bypassed, the attacker can access underlying Windows operating system functions even when Freelance Operations is active, depending on system configuration and user permissions.

The vulnerability affects ABB Freelance distributed control systems deployed globally in critical manufacturing environments. While exploitation requires physical access to the system and cannot be exploited remotely, successful exploitation could compromise the security posture of industrial control systems by allowing unauthorized access to OS-level functions and user management. ABB has published security advisory 7PAA020361 with additional mitigation guidance.

CISA recommends standard ICS security practices including network segmentation, minimizing exposure to the internet, and implementing defense-in-depth strategies. No known public exploitation has been reported to CISA at this time.

title: Shell Process Spawned From ABB Freelance Security Lock
id: a1ac8b79-3d7e-517f-ae54-1b2f9d45d56c
status: experimental
description: 'Detects command shells, Explorer, Task Manager, or MMC being spawned
  with an ABB Freelance Security Lock (kiosk/HMI lock) process as parent. This behaviour
  is consistent with CVE-2025-7064, an authentication bypass in ABB Freelance Security
  Lock that allows an attacker with physical access to use special keyboard combinations
  to escape the kiosk lock screen and reach underlying Windows OS functions.

  '
references:
- CVE-2025-7064
- ABB advisory 7PAA020361
author: Vorant
tags:
- attack.t1078
- attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
    - SecurityLock
    - FreelanceLock
    - FlexLock
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\explorer.exe
    - \\taskmgr.exe
    - \\mmc.exe
    - \\control.exe
  filter:
    ParentImage|endswith: \\explorer.exe
  condition: selection and not filter
falsepositives:
- Legitimate maintenance sessions where operators are authorized to exit the lock
  screen via documented procedures
- Vendor-approved break-glass access using an authenticated unlock mechanism instead
  of the keyboard shortcut bypass
level: high

title: Termination of ABB Freelance Security Lock Process
id: 7cd6cdac-ff4b-50c4-b076-1587b088454e
status: experimental
description: 'Detects use of taskkill.exe or PowerShell Stop-Process cmdlets targeting
  the ABB Freelance Security Lock kiosk process by name. Terminating this process
  directly disables the ICS operator lock screen, an Impair Defenses technique that
  may follow or accompany exploitation of CVE-2025-7064.

  '
references:
- CVE-2025-7064
- ABB advisory 7PAA020361
author: Vorant
tags:
- attack.t1685
- attack.defense-impairment
logsource:
  category: process_creation
  product: windows
detection:
  selection_taskkill:
    Image|endswith: \\taskkill.exe
    CommandLine|contains:
    - SecurityLock
    - FreelanceLock
    - FlexLock
  selection_powershell:
    Image|endswith:
    - \\powershell.exe
    - \\pwsh.exe
    CommandLine|contains:
    - SecurityLock
    - FreelanceLock
    - FlexLock
  condition: 1 of selection_*
falsepositives:
- Authorized administrative maintenance scripts that restart the lock service as part
  of patching or configuration updates
level: medium

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-05

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.