MICROSYS PROMOTIC Vulnerabilities

An attacker with network access to PROMOTIC could exploit path traversal or buffer overflow vulnerabilities to read, write, or execute code on systems running the application, potentially disrupting monitoring and control of industrial processes.

This affects operators running PROMOTIC as a supervisory control and data acquisition (SCADA) or human-machine interface (HMI) platform for industrial monitoring. Water utilities, power facilities, and manufacturing plants using PROMOTIC for process visualization and control should assess their exposure. The vulnerability is particularly concerning if PROMOTIC instances are accessible from networked engineering workstations or remote access points.

An attacker on the same network as a PROMOTIC installation could send a crafted request exploiting path traversal (CWE-22) to access files outside the intended directory, or trigger a buffer overflow (CWE-119) by sending oversized input to a vulnerable code path. This could allow reading sensitive files, modifying configuration, or achieving code execution on the machine running PROMOTIC.