CVE-2025-13162

MediumCVSS 4.4/10Last modified Oct 6, 2026

Description

Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master.

This issue affects Control Builder A: through 1.4/4; 800xA for Advant Master: through 6.0.3-1, through 6.1.1-1, 6.1.1-3, 6.2.0-1.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-427

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
ABB	Control Builder A	<= 1.4/4
ABB	800xA for Advant Master	<= 6.0.3-1; <= 6.1.1-1; 6.1.1-3; 6.2.0-1

References

https://search.abb.com/library/Download.aspx?DocumentID=7PAA020047&LanguageCode=en&DocumentPartId=&Action=Launch

Timeline

Published: Jun 23, 2026
Last modified: Oct 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-131634.9EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain p CVE-2025-131644.9EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain p CVE-2025-131657.5EasyFlow GP developed by Digiwin has a Denial of service vulnerability, allowing unauthenticated remote attackers to send specific requests CVE-2025-131663.7The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on CVE-2025-131675.4Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Cont CVE-2025-131689.8A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_e CVE-2025-131699.8A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown c CVE-2025-131709.8A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the CVE-2025-131718.8A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of the CVE-2025-131728.8A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-r CVE-2025-131736.5Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initia CVE-2025-131746.3A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /r