ABB Advant Master Online Builder DLL Flaw
ABB shipped an outdated Online Builder version in Advant Master and 800xA products, exposing an uncontrolled DLL search path that could let a local attacker execute arbitrary code.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
ABB disclosed that certain releases of Advant Master Online Builder (ONB), used in Control Builder A and 800xA for Advant Master, inadvertently shipped an older, vulnerable version of the component. The flaw, tracked as CVE-2025-13162 (CWE-427, Uncontrolled Search Path Element), stems from insufficient restrictions on the application directory where DLLs are loaded, allowing an attacker with local access to plant a malicious library that would be executed by the system, resulting in arbitrary code execution and compromise of system integrity.
Exploitation requires physical or local access to the affected node; there is no remote attack vector, and ABB states functional safety is not impacted. The issue was discovered internally through ABB's security assessment process, has not been publicly disclosed prior to this advisory, and ABB has no evidence of in-the-wild exploitation. Notably, some intermediate fix versions (6.1.1-4, 6.2.0-2) were withdrawn because installer tooling could still present the vulnerable 6.1.1-3/6.2.0-1 builds, complicating remediation tracking.
ABB recommends updating Control Builder A to 1.4/5 or later, and 800xA for Advant Master to 6.1.1-5 or 6.2.0-3 or later depending on branch. CISA republished the advisory to increase visibility for critical manufacturing sector operators using these ICS products worldwide, and recommends standard ICS network segmentation, restricting removable media, and enforcing strong access controls as compensating measures.
Mentioned in this report
Detection guidance
Unsigned DLL Loaded From ABB Advant/800xA Application Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects an unsigned DLL being loaded from the ABB Advant Master Online Builder / Control Builder A / 800xA application directory, consistent with exploitation of the uncontrolled search path element (CVE-2025-13162) to plant and load a malicious library alongside the legitimate binary. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unsigned DLL Loaded From ABB Advant/800xA Application Directory
description: Detects image loads of unsigned DLLs from ABB Advant Master Online Builder,
Control Builder A, or 800xA for Advant Master installation directories. These products
were found to search an uncontrolled application directory for DLLs (CVE-2025-13162),
allowing local attackers to plant a malicious library that gets loaded instead of
the intended one. Generalises on the vendor directory and the unsigned/loaded-from-app-dir
pattern rather than any specific filename.
tags:
- attack.stealth
- attack.persistence
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
Image|contains:
- \ABB\
- \Advant
- 800xA
unsigned:
Signed: false
filter_system_dll:
ImageLoaded|contains:
- \Windows\System32\
- \Windows\SysWOW64\
condition: selection and unsigned and not filter_system_dll
falsepositives:
- Legitimate third-party plugins or drivers shipped unsigned by smaller vendors and
co-located in the same ABB application directory
- Freshly installed ABB components whose DLLs have not yet been re-signed after an
update
level: medium
id: 2bf1e55c-0e21-521c-8b3d-3637ce1e9f86
status: experimental
author: Vorant
New DLL Written Into ABB Advant/800xA Application Directory by Non-Installer Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a DLL file being created inside an ABB Advant/Control Builder A/800xA application directory by a process other than the expected ABB installer or update service, indicative of planting a malicious library to exploit the uncontrolled search path flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New DLL Written Into ABB Advant/800xA Application Directory by Non-Installer
Process
description: Detects creation of a .dll file inside ABB Advant Master Online Builder,
Control Builder A, or 800xA for Advant Master directories by a process that is not
the ABB installer/update tooling. This mirrors the planting stage of an uncontrolled
search path element attack (CVE-2025-13162), where an attacker with local access
drops a malicious DLL into the vulnerable application directory ahead of execution.
tags:
- attack.persistence
- attack.stealth
- attack.t1574.001
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \ABB\
- \Advant
- 800xA
TargetFilename|endswith: .dll
filter_installer:
Image|endswith:
- \msiexec.exe
- \ABBInstall.exe
- \setup.exe
condition: selection and not filter_installer
falsepositives:
- Legitimate ABB patch or upgrade activity performed outside of tracked installer
processes (e.g., manual file copy during maintenance)
- Backup or file synchronization tools restoring DLLs into the ABB directory tree
level: medium
id: e02f7ebb-5d5e-5dfd-ad0b-d3dc090b7f4b
status: experimental
author: Vorant
ABB Advant/Control Builder Process Loading DLL From User-Writable Path
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects ABB Advant Master Online Builder / Control Builder A processes loading a DLL from a user-writable location (e.g. Temp, AppData, or removable media root) rather than the standard installation or system directories, consistent with local exploitation of the DLL search path weakness. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ABB Advant/Control Builder Process Loading DLL From User-Writable Path
description: Detects ABB Advant Master Online Builder / Control Builder A / 800xA
processes loading DLLs from user-writable locations such as Temp, AppData, Downloads,
or removable-media drive roots. Because the affected component searches an uncontrolled
application directory for DLLs (CVE-2025-13162), an attacker with local or physical
access could stage a malicious DLL in such a writable location for it to be picked
up and executed by the vulnerable process.
tags:
- attack.persistence
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
Image|contains:
- \ABB\
- \Advant
- 800xA
ImageLoaded|contains:
- \Temp\
- \AppData\
- \Downloads\
condition: selection
falsepositives:
- Support engineers manually copying updated ABB DLLs into a user profile for testing
before formal deployment
- Third-party diagnostic tools that stage helper libraries in AppData for the ABB
engineering suite
level: medium
id: 64f7dba6-a880-51f8-bcbe-dc60e8acad73
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-195-01
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs