As reported by CISA in ICS Advisory ICSA-26-195-01, ABB has disclosed a vulnerability affecting the Advant Master Online Builder (ONB) component, stemming from an incorrect version being bundled in distributed installation media. While the CVSS score of 4.4 may initially suggest a moderate-severity issue, the operational technology (OT) context in which these systems are deployed elevates the real-world risk considerably.
Vulnerability Breakdown
- CVE ID
- CVE-2025-13162
- CVSS v3 Score
- 4.4 (Medium) — though context-dependent risk is higher in OT environments
- Vulnerability Type
- CWE-427: Uncontrolled Search Path Element (DLL Search Order Hijacking)
- Affected Products
-
- Control Builder A — versions ≤1.4/4
- 800xA for Advant Master — versions ≤6.0.3-1, ≤6.1.1-1, 6.1.1-3, 6.2.0-1
- Vendor
- ABB Ltd. (Headquarters: Switzerland)
- Patch Available
- Yes — ABB has issued an update. Refer to the CISA advisory and ABB's own security bulletin for update procedures.
- Active Exploitation Observed
- Not reported at time of advisory. No known public exploit code confirmed.
- Deployment Scope
- Worldwide — critical manufacturing sector
Why This Matters More Than the Score Suggests
DLL search order hijacking is a well-understood but persistently underestimated attack class. When an application fails to specify an absolute path for loading dynamic-link libraries, Windows resolves the path using a priority-ordered search sequence — one that attackers can manipulate by planting a malicious DLL in a directory the application searches before the legitimate one. The result: arbitrary code execution running under the context of the hijacked process.
In IT environments, a CVSS 4.4 might warrant scheduled patching. In OT and industrial control system (ICS) environments, the calculus changes entirely. ABB's Advant Master and 800xA platforms are deployed in critical manufacturing — environments where process integrity is paramount and where engineering workstations often operate with elevated privileges, minimal endpoint detection tooling, and infrequent patch cycles. An attacker who achieves initial access to an engineering workstation — even through phishing or lateral movement from a compromised IT segment — could exploit this flaw to escalate persistence or pivot deeper into the control layer.
The supply-chain dimension of this advisory also deserves attention. ABB identified the vulnerability not in a software design flaw per se, but in the media packaging process — an incorrect ONB version was included in distributed installation packages. This is a subtle but important distinction: organizations that installed from official media may be unknowingly running a vulnerable component. This underscores the importance of verifying software integrity against vendor-provided hashes at the time of installation, not merely trusting the source.
Who Is Most Exposed
Shield53 Recommendations
Immediate Actions
- Verify installed versions immediately. Cross-reference your deployed Control Builder A and 800xA for Advant Master versions against the affected version list. Even if you believe you're patched, confirm the ONB component version explicitly.
- Apply ABB's update. Follow the vendor-recommended update procedure outlined in the CISA advisory. Coordinate with your change management process, but treat this as priority patching given the OT context.
- Audit DLL search path exposure. Review the directories in the application's search path. Remove write permissions for non-administrative users on directories that precede system directories in the search order.
- Check installation media integrity. If your deployment used physical or downloaded media, verify file hashes against ABB's published checksums. Reinstall from verified clean media if discrepancies exist.
Defensive Hardening
- Deploy application whitelisting (e.g., Windows Defender Application Control or equivalent) on engineering workstations to block unauthorized DLL loading.
- Implement network segmentation between IT and OT zones — engineering workstations should not be reachable directly from general corporate networks.
- Enable Windows SafeDllSearchMode (registry setting) if not already enforced via Group Policy, to reduce the attack surface for DLL hijacking broadly.
- Monitor for anomalous DLL loads from non-standard directories using EDR telemetry or Sysmon Event ID 7 (ImageLoad) on any endpoints where this software is present.
Shield53 Perspective: A CVSS 4.4 in a boardroom slide understates the real risk in a plant floor context. The combination of DLL hijacking, privileged engineering workstations, and the supply-chain packaging angle makes this a patch-now situation for any organization running ABB Advant Master in production.
