Entevo HMI EUVD-2026-64900

Exploitation requires a local, low-privilege Windows session on the affected Entevo HMI V2 R5 P0 M4 workstation, consistent with the CVSS vector PR:L and AV:L. The attacker must be able to interact with the HMI application UI - specifically triggering the in-app PDF manual viewer - to cause the external PDF reader to launch. The Print dialog in that external viewer must not be blocked by OS-level application control policies such as AppLocker or WDAC. No network access, no remote attack vector, and no interaction from a second privileged user are required. Exploitation is limited to individuals who can physically or remotely log into the HMI console with at least minimal credentials; fully unauthenticated remote exploitation is not possible. The attack functions against the standard Kiosk Mode deployment without requiring any unusual or non-default configuration changes.

The CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local attack vector and full CIA impact - this is not remotely exploitable and requires physical or session-level access to the HMI console. The EPSS score of 0.17% (6th percentile) signals very low probability of broad automated exploitation, consistent with the SSVC assessment of Exploitation: none and Automatable: no. However, SSVC also rates Technical Impact as total, meaning a successful exploit fully compromises the affected workstation. The existence of a public GitHub gist documenting the technique meaningfully reduces the attacker skill requirement for anyone who can reach the console. In OT and ICS environments, HMI terminals are frequently shared among plant floor personnel with minimal credentials and are difficult to patch during active production cycles - factors that elevate practical risk above what the raw EPSS figure suggests. There is no tension between the CVSS vector and the description; both consistently point to a local, low-privilege, interactive attack. The primary risk is insider threat or physical-access scenarios rather than remote mass exploitation.

A plant floor operator with a low-privilege Windows session on an Entevo HMI kiosk opens the application's built-in help manual, which launches an external PDF reader. The operator uses the viewer's Print dialog to browse the file system, locates cmd.exe, and executes it - obtaining an administrative command prompt on the HMI workstation. A public GitHub gist documents the precise technique, meaning any attacker with local session access and knowledge of the gist can replicate the attack without advanced skills.