ABB Panel Builder 800 DLL Hijacking Vulnerability (Update A)

An attacker with local administrative access to an engineering workstation running Panel Builder 800 could execute arbitrary code with the privileges of the application, potentially allowing them to modify HMI (human-machine interface) configurations, historical data, or interfere with process control logic deployed through the Panel Builder environment.

Organizations running ABB Panel Builder 800 for HMI development and configuration, particularly utilities and manufacturers that use ABB control systems for SCADA, process automation, or plant-level monitoring. Any organization deploying ABB automation solutions through Panel Builder 800 is affected if they use version 5.1 or earlier on unpatched engineering workstations.

An attacker must first gain local access to a workstation running Panel Builder 800 with high privileges. They then place a malicious DLL in a directory that Panel Builder searches during startup (typically the application's working directory or system path). When an authorized user launches Panel Builder or opens a project, the application loads the hijacked DLL instead of the legitimate library, executing the attacker's code.