CVE-2024-5402 is a High severity (CVSS 7.8) unquoted search path flaw in ABB Mint Workbench I. A local attacker who can write to the right folder could gain elevated privileges. ABB says version 5868 fixes it, and it also publishes a registry workaround.
What's affected
- Product: ABB Mint Workbench I, the engineering tool for Mint motion control.
- Affected versions: the record says from 5866 before 5868. ABB's advisory says "through version 5866". Those two statements differ at the edges, so treat 5866 and anything older as affected.
- Fixed version: 5868. ABB says the fix shipped in 2021, and the advisory was published later because some customers still run old builds.
- Severity: High, CVSS 7.8 in both the record and ABB's advisory. ABB also lists a temporal score of 7.0 and a CVSS v4.0 score of 6.2, which is lower than the base score.
- Exploitation: the record's KEV flag is false. ABB's advisory states it is not an affirmation of an active threat.
How to check if you're exposed
ABB says the version appears on the startup page and under Help, About Mint Workbench. Check that first on every engineering workstation and server that runs it.
You can also inspect the affected service entry. On Windows, the Mint HTTP Server service stores its path in the registry. In an elevated PowerShell session:
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Mint HTTP Server" | Select-Object ImagePath
If the ImagePath value contains spaces and is not wrapped in quotation marks, the entry is unquoted. A properly quoted path starts and ends with a quote character.
What to do now
- Inventory every machine with Mint Workbench I installed and record the build number.
- For builds at 5866 or older, download the current installer from ABB's official site and run it as a full upgrade. ABB says the installer detects and removes the old version.
- If you cannot upgrade yet, apply ABB's workaround. Open the registry editor with administrator rights, go to the Mint HTTP Server service key, and enclose the ImagePath string in quotation marks.
- Review write permissions on the folders along the service path. ABB's mitigating factor is that an attacker needs local access and write access in that path.
- Limit who can log on locally to machines that run the tool.
Why it matters
The record maps this to CWE-428, unquoted search path or element. When Windows starts a service whose path has spaces and no quotes, it may try shorter versions of the path first. A file placed at one of those earlier locations can run instead of the real program, and services often run with high privileges.
The attack needs a foothold, so it is a second stage problem rather than a way in. That still matters on shared engineering machines, where a low privileged account is easier to obtain than an administrator. This is also a reminder that a fix can exist for years before a CVE is published, so old installers on shared drives deserve a look.
Quick check
Can this be exploited remotely?
The vector is local (AV:L), and ABB says the attacker needs local access and file write access in the path. It is not a remote entry point on its own.
Is there a fix besides upgrading?
Yes. ABB documents a registry workaround that wraps the ImagePath value of the Mint HTTP Server service in quotation marks. Upgrading to 5868 or later is still the recommended path.
Sources
- ABB Cyber Security Advisory 9AKK108469A7912, Mint Workbench I Unquoted Service Path Enumeration
- NVD record data for CVE-2024-5402, as supplied in the batch record
Last reviewed: 19 October 2026.
