Conprosys Hmi System Chs
Monthly
Eval injection in CONPROSYS HMI System (CHS) by Contec allows authenticated network attackers to execute arbitrary code on the server hosting the HMI application. The flaw (CWE-95) occurs when user-supplied input reaches a dynamic code evaluation function without proper neutralization, enabling full server-side code execution. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, network-accessible nature of the vulnerability makes it a priority for ICS/OT environments running this product.
Eval injection in CONPROSYS HMI System (CHS) by Contec allows authenticated network attackers to execute arbitrary code on the server hosting the HMI application. The flaw (CWE-95) occurs when user-supplied input reaches a dynamic code evaluation function without proper neutralization, enabling full server-side code execution. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, network-accessible nature of the vulnerability makes it a priority for ICS/OT environments running this product.