CVE-2022-31216: 
ABB Drive Composer pro vulnerability analysis and mitigation

The vulnerability (CVE-2022-31216) affects ABB's Drive Composer, Automation Builder, and Mint Workbench software platforms. Discovered in January 2022 and publicly disclosed in July 2022, this vulnerability allows low-privileged attackers to create and write files anywhere on the file system with SYSTEM privileges. The affected versions include ABB Drive Composer Entry and Pro (versions 2.0 to 2.7), ABB Automation Builder (versions 1.1.0 to 2.5.0), and Mint Workbench (builds 5866 and prior) (CISA Advisory).

The vulnerability is classified as an Improper Privilege Management issue (CWE-269) with a CVSS v3 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The specific flaw exists within the Drive Composer installer, where a low-privileged user can exploit the 'repair' operation functionality. By creating a symbolic link, an attacker can abuse the installer to overwrite files with arbitrary content when the target file doesn't already exist (ZDI Advisory, CISA Advisory).

Successful exploitation of this vulnerability enables attackers to escalate privileges and execute arbitrary code in the context of SYSTEM, potentially leading to complete system compromise. The vulnerability affects multiple critical infrastructure sectors worldwide, with ABB's headquarters located in Switzerland (CISA Advisory, ZDI Advisory).

The vulnerability requires local access and cannot be exploited remotely. An attacker must first obtain the ability to execute low-privileged code on the target system. As of the advisory release, there were no known public exploits specifically targeting this vulnerability (CISA Advisory).

ABB has released updates to address this vulnerability. Users should upgrade to ABB Drive Composer v2.7.1 or later, ABB Automation Builder 2.5.1 or later, and ABB Mint Workbench Build 5868 or later. Additional recommended security measures include minimizing network exposure for control system devices, ensuring systems are not accessible from the Internet, and implementing secure remote access methods such as VPNs (CISA Advisory).