Wonderware InBatch Client ActiveX Buffer Overflow

An attacker could run arbitrary code on the InBatch Runtime Client with no authentication required, potentially altering recipe parameters, batch process logic, or stopping batch operations entirely.

Batch process operators and manufacturing control system administrators at pharmaceutical, chemical, and food & beverage facilities using Wonderware InBatch 8.1 or 9.0 for recipe development and batch execution on Windows workstations.

An attacker sends a specially crafted network packet to the InBatch Runtime Client ActiveX component over the network (likely port 3382 or similar). The packet triggers a buffer overflow in memory handling, allowing the attacker to execute arbitrary commands on the client workstation with the same privileges as the application.