ABB Advant Master Online Builder DLL Flaw

14 July 2026 medium vulnerability manufacturing

ABB shipped an outdated Online Builder version in Advant Master and 800xA products, exposing an uncontrolled DLL search path that could let a local attacker execute arbitrary code.

ABB disclosed that certain releases of Advant Master Online Builder (ONB), used in Control Builder A and 800xA for Advant Master, inadvertently shipped an older, vulnerable version of the component. The flaw, tracked as CVE-2025-13162 (CWE-427, Uncontrolled Search Path Element), stems from insufficient restrictions on the application directory where DLLs are loaded, allowing an attacker with local access to plant a malicious library that would be executed by the system, resulting in arbitrary code execution and compromise of system integrity.

Exploitation requires physical or local access to the affected node; there is no remote attack vector, and ABB states functional safety is not impacted. The issue was discovered internally through ABB's security assessment process, has not been publicly disclosed prior to this advisory, and ABB has no evidence of in-the-wild exploitation. Notably, some intermediate fix versions (6.1.1-4, 6.2.0-2) were withdrawn because installer tooling could still present the vulnerable 6.1.1-3/6.2.0-1 builds, complicating remediation tracking.

ABB recommends updating Control Builder A to 1.4/5 or later, and 800xA for Advant Master to 6.1.1-5 or 6.2.0-3 or later depending on branch. CISA republished the advisory to increase visibility for critical manufacturing sector operators using these ICS products worldwide, and recommends standard ICS network segmentation, restricting removable media, and enforcing strong access controls as compensating measures.

Mentioned in this report

Vulnerabilities CVE-2025-13162

Detection guidance

Unsigned DLL Loaded From ABB Advant/800xA Application Directory

ATT&CK T1574.001

Detects an unsigned DLL being loaded from the ABB Advant Master Online Builder / Control Builder A / 800xA application directory, consistent with exploitation of the uncontrolled search path element (CVE-2025-13162) to plant and load a malicious library alongside the legitimate binary. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unsigned DLL Loaded From ABB Advant/800xA Application Directory
description: Detects image loads of unsigned DLLs from ABB Advant Master Online Builder,
  Control Builder A, or 800xA for Advant Master installation directories. These products
  were found to search an uncontrolled application directory for DLLs (CVE-2025-13162),
  allowing local attackers to plant a malicious library that gets loaded instead of
  the intended one. Generalises on the vendor directory and the unsigned/loaded-from-app-dir
  pattern rather than any specific filename.
tags:
- attack.defense-evasion
- attack.persistence
- attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|contains:
    - \ABB\
    - \Advant
    - 800xA
  unsigned:
    Signed: false
  filter_system_dll:
    ImageLoaded|contains:
    - \Windows\System32\
    - \Windows\SysWOW64\
  condition: selection and unsigned and not filter_system_dll
falsepositives:
- Legitimate third-party plugins or drivers shipped unsigned by smaller vendors and
  co-located in the same ABB application directory
- Freshly installed ABB components whose DLLs have not yet been re-signed after an
  update
level: medium
id: 2bf1e55c-0e21-521c-8b3d-3637ce1e9f86
status: experimental
author: Vorant

New DLL Written Into ABB Advant/800xA Application Directory by Non-Installer Process

ATT&CK T1574.001

Detects a DLL file being created inside an ABB Advant/Control Builder A/800xA application directory by a process other than the expected ABB installer or update service, indicative of planting a malicious library to exploit the uncontrolled search path flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: New DLL Written Into ABB Advant/800xA Application Directory by Non-Installer
  Process
description: Detects creation of a .dll file inside ABB Advant Master Online Builder,
  Control Builder A, or 800xA for Advant Master directories by a process that is not
  the ABB installer/update tooling. This mirrors the planting stage of an uncontrolled
  search path element attack (CVE-2025-13162), where an attacker with local access
  drops a malicious DLL into the vulnerable application directory ahead of execution.
tags:
- attack.persistence
- attack.defense-evasion
- attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \ABB\
    - \Advant
    - 800xA
    TargetFilename|endswith: .dll
  filter_installer:
    Image|endswith:
    - \msiexec.exe
    - \ABBInstall.exe
    - \setup.exe
  condition: selection and not filter_installer
falsepositives:
- Legitimate ABB patch or upgrade activity performed outside of tracked installer
  processes (e.g., manual file copy during maintenance)
- Backup or file synchronization tools restoring DLLs into the ABB directory tree
level: medium
id: e02f7ebb-5d5e-5dfd-ad0b-d3dc090b7f4b
status: experimental
author: Vorant

ABB Advant/Control Builder Process Loading DLL From User-Writable Path

ATT&CK T1574.001

Detects ABB Advant Master Online Builder / Control Builder A processes loading a DLL from a user-writable location (e.g. Temp, AppData, or removable media root) rather than the standard installation or system directories, consistent with local exploitation of the DLL search path weakness. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: ABB Advant/Control Builder Process Loading DLL From User-Writable Path
description: Detects ABB Advant Master Online Builder / Control Builder A / 800xA
  processes loading DLLs from user-writable locations such as Temp, AppData, Downloads,
  or removable-media drive roots. Because the affected component searches an uncontrolled
  application directory for DLLs (CVE-2025-13162), an attacker with local or physical
  access could stage a malicious DLL in such a writable location for it to be picked
  up and executed by the vulnerable process.
tags:
- attack.persistence
- attack.defense-evasion
- attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|contains:
    - \ABB\
    - \Advant
    - 800xA
    ImageLoaded|contains:
    - \Temp\
    - \AppData\
    - \Downloads\
  condition: selection
falsepositives:
- Support engineers manually copying updated ABB DLLs into a user profile for testing
  before formal deployment
- Third-party diagnostic tools that stage helper libraries in AppData for the ABB
  engineering suite
level: medium
id: 64f7dba6-a880-51f8-bcbe-dc60e8acad73
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-01

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free