Schneider Electric ProClima ActiveX Control Vulnerabilities

An attacker could execute arbitrary code on a workstation running ProClima by tricking a user into opening a malicious file or webpage, potentially compromising the engineering workstation and the data it accesses, including process configurations and setpoints.

Energy sector operators using Schneider Electric ProClima for building or industrial control system engineering and configuration. This affects any personnel using ProClima on workstations that have internet access or receive files from external sources.

An attacker crafts a malicious web page or document that exploits the ActiveX control vulnerability. When a ProClima user opens the page or document in a web browser or application, the attacker's code runs with the user's privileges on the workstation. From there, the attacker could access ProClima configuration files, modify control logic, or pivot to connected control systems.