ABB 800xA CVE-2025-13162

Exploitation requires all of the following: (1) Local access to the engineering workstation - no remote exploitation path exists (AV:L). (2) The attacker must hold at least low-privilege credentials on the host (PR:L); unauthenticated or anonymous access is insufficient. (3) High attack complexity (AC:H) - the attacker must identify and successfully place a malicious DLL in a specific directory that the application searches before its legitimate library location; this requires knowledge of the application's DLL search order. (4) A legitimate, potentially higher-privileged user must launch Control Builder A or the 800xA application after the DLL is planted (UI:R) - exploitation cannot be triggered solely by the attacker's own actions. Factors limiting exploitation: the combination of local-only access, required user interaction, and high complexity substantially constrains the attack surface to insider threats or physically present attackers on OT engineering workstations; the scope is unchanged (S:U), meaning a successful exploit does not inherently pivot to other network systems directly.

CVSS 3.1 scores this at 4.4 (Medium), with the vector AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N indicating several meaningful constraints on exploitation: local access is required (no remote attack path), attack complexity is high (specific search path conditions must be pre-arranged), low privileges are still required on the host, and a legitimate privileged user must interact with the application to trigger loading. The integrity impact is high - successful exploitation yields code execution - but confidentiality and availability impacts are none per the CVSS assessment. EPSS data is not provided in the available intelligence. No KEV listing and no public exploit confirm this is not currently being mass-exploited. The 'Information Disclosure' tag in the source data conflicts directly with CVSS C:N - this discrepancy should be verified against the ABB advisory (7PAA020047); it may reflect a secondary or indirect information exposure not captured in the base score, or it may be a tagging error. Real-world priority should be moderate: the OT/ICS deployment context makes even local-privilege attacks consequential, but the AC:H and UI:R constraints significantly limit opportunistic exploitation.

A low-privileged local user on an ABB 800xA engineering workstation - for example, a contractor or operator account with access to the machine - identifies a user-writable directory that appears in the DLL search order before the application's install directory. They plant a malicious DLL with the expected name in that directory. When a higher-privileged operator or engineer next launches Control Builder A or 800xA (providing the required user interaction), the application loads the attacker's DLL instead of the legitimate one, executing the attacker's payload with the privileges of the launching user. No public proof-of-concept is known at time of analysis.