Description

An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS). If exploited, arbitrary code may be executed by an attacker who can log in to the product.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T07:17:20.920Z",
  "pubdate": "2026-09-14T07:17:20.920Z",
  "executiveSummary": "The CONPROSYS HMI System (CHS) is susceptible to an improper neutralization of directives in dynamically evaluated code, classified as an Eval Injection vulnerability.\nThis security flaw allows an authenticated attacker to inject and execute arbitrary code within the context of the application's runtime environment.\nThe vulnerability resides in the way the product handles dynamically evaluated code inputs, leading to a breakdown in secure code execution boundaries.\nThe primary impact is full system compromise, as the ability to execute arbitrary code grants the attacker unauthorized control over the HMI environment.\nSuccessful exploitation requires the attacker to possess valid credentials to log in to the product.\nGiven the nature of HMI systems in industrial and automation environments, this risk implies potential loss of operational integrity, unauthorized process control, and lateral movement within the production network.",
  "technicalDetails": "The vulnerability is rooted in the unsafe implementation of dynamic code evaluation functions within the CONPROSYS HMI System (CHS).\nWhen the application processes user-supplied data, it fails to sufficiently neutralize input before passing it to an evaluation engine or interpreter, such as eval() or similar dynamic execution primitives.\nThe attack flow initiates after the attacker successfully authenticates to the CHS platform. Once inside the application interface, the attacker identifies input fields or parameters that are subsequently processed by the server-side dynamic evaluation logic.\nBy crafting a malicious payload containing system-level commands or code snippets, the attacker can force the backend interpreter to execute the injected directives.\nBecause the evaluated code runs with the privileges of the service account under which the CONPROSYS HMI System operates, the attacker effectively inherits those permissions on the underlying host operating system.\nThe exploitation process typically involves: 1) Establishing a legitimate session via authentication. 2) Locating a target endpoint or function that performs dynamic evaluation on user-provided variables. 3) Injecting syntactically correct code into the targeted input vector. 4) Triggering the evaluation routine, which forces the execution of the payload.\nThe post-exploitation impact includes persistent code execution, unauthorized data exfiltration, modification of HMI monitoring and control logic, and the deployment of additional malicious tools to further entrench the attacker's presence within the industrial network infrastructure.\nThe vulnerability highlights a critical failure in input validation and the use of dangerous functions that do not employ strict allow-lists or sandboxing techniques. By failing to sanitize directives embedded within the data stream, the application becomes a vehicle for remote code execution (RCE) once an authenticated user boundary is breached."
}