ABB Automation Builder 2.9.1 Fixes Project File Code Execution
Tech GuruQuick Answer
ABB fixes CVE-2025-41700 in Automation Builder 2.9.1. A specially crafted project or archive can lead to code execution when a user opens it and uses print/printer configuration or prints project content. The code runs with that user's permissions on the engineering workstation.
Confirm Scope And Apply The Supported Fix
What to do now: update the engineering tool through ABB's supported channel, preserving project backups and compatibility requirements. Until verified, avoid untrusted projects and their print settings. Do not mistake this workstation update for the separate AC500 controller firmware update.
Last verified: October 2, 2026 UTC against ABB CSAF revision 1. No project file or print engine was executed.
Scope And Authority
| Product scope | ABB Automation Builder releases before 2.9.1 |
|---|---|
| Advisory | 3ADR011566 |
| CVE | CVE-2025-41700 |
| Authoritative release date | 2026-09-28 00:30:00 UTC (ABB CSAF initial release); added to the ABB CSAF feed at 2026-09-28 12:15:00 UTC |
| Authority revision date | 2026-09-28 00:30:00.000 UTC |
| Affected versions | ABB Automation Builder before 2.9.1 when a user opens a crafted project or project archive and invokes print or printer configuration. |
| Fixed version | ABB Automation Builder 2.9.1 |
| CVSS base score | 7.8 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | ABB reported no information indicating exploitation at initial advisory issue; this is not a statement about all later activity. |
What Changed
The issue is untrusted-data deserialization in the print engine. Opening a project is part of the attack sequence; the advisory also identifies print or printer-configuration interaction. Treat project provenance as relevant even on a workstation with restricted network access.
What To Validate Now
- Match the tool. Record the installed Automation Builder version and project dependencies, not just connected PLC firmware.
- Preserve and update. Back up the project and required configuration, then follow ABB's supported 2.9.1 or later fixed-release upgrade path in a maintenance window.
- Test a trusted project. Reopen known-good content and exercise print configuration and project printing in the approved test environment. Do not test an unknown archive on an engineering station connected to production.
- Retain results. Keep installer identity, resulting tool version and print checks. An already compromised workstation needs investigation and credential review, not merely an updated application.
Operational Cautions
ABB mentions a local-access-only workaround, but neither the CSAF notice nor its companion PDF supplies the referenced configuration steps. Obtain that procedure from ABB before relying on it. Network restrictions do not by themselves establish that a crafted project file cannot reach a user; preserve the file-trust and user-interaction precautions while arranging the update.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
