OTPulse

ABB Automation Builder - Deserialization of untrusted data

Plan PatchCVSS 7.83adr011566Sep 28, 2026
ABB
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

ABB Automation Builder versions prior to 2.9.1 contain a deserialization vulnerability in project file handling. An attacker could craft a malicious project file or archive that executes arbitrary code when opened in Automation Builder. The vulnerability allows code execution through unsafe deserialization of untrusted data in project files.

What this means
What could happen
An attacker could craft a malicious project file to execute arbitrary code on an engineering workstation running Automation Builder, potentially allowing them to modify control logic, steal project configurations, or compromise the workstation.
Who's at risk
Engineering teams and automation engineers using ABB Automation Builder to develop and manage control logic for industrial processes, including programmable logic controllers (PLCs) and distributed control systems (DCS).
How it could be exploited
An attacker sends a crafted project file or archive to an engineer. When the engineer opens the file in Automation Builder, malicious code is executed during deserialization, allowing the attacker to run arbitrary commands on the workstation.
Prerequisites
  • User interaction required - engineer must open a malicious project file
  • Local system access or ability to deliver malicious file to engineering workstation
Requires user interactionLocal attack vectorCould lead to control logic modificationAffects engineering workstations
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (1)
ProductAffected VersionsFix Status
Automation Builder <2.9.1<2.9.12.9.1
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDRestrict Automation Builder to local network access only and disable external project imports until the update is applied
HARDENINGImplement file validation procedures for project files received from external sources before opening in Automation Builder
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Automation Builder to version 2.9.1 or later
Long-term hardening
0/1
HARDENINGRestrict user access to Automation Builder to trusted engineering staff only
View full ABB PSIRT advisory
API: /api/v1/advisories/2cb332da-263f-4a07-9ee5-f3a70198e2a4

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.