Drive Composer Path Traversal Vulnerability

An attacker could bypass file path restrictions and access arbitrary files on the engineering workstation running Drive Composer, potentially reading sensitive motor control configurations, stealing credentials, or executing code to compromise the machine.

Drive system engineers and automation technicians who use ABB Drive Composer (entry or pro) to configure and program ABB motor drives. This affects any site running an older version of Drive Composer on engineering workstations or centralized configuration servers.

An attacker with network access to the Drive Composer software (likely via web interface or local network if exposed) supplies a specially crafted file path request using traversal techniques (e.g., ../ sequences). The vulnerability fails to properly validate the path, allowing the attacker to read or write files outside the intended directory, such as system configuration files, credential stores, or executable locations.