Solar Controls Heating Control Downloader (HCDownloader)

An attacker with physical or local network access to a workstation running HCDownloader could execute arbitrary code with the privileges of the logged-in user, potentially allowing them to modify heating control configurations, disrupt heating system operations, or gain further access to the plant network.

Organizations using Solar Controls HCDownloader for heating system configuration and management should be concerned. This includes facility managers, HVAC technicians, and engineering staff at utilities, commercial buildings, and industrial plants that rely on HCDownloader for heating control programming and downloads.

An attacker places a malicious file (DLL, library, or script) in a directory that HCDownloader searches during startup or when loading dependencies—such as the application directory, a shared temp folder, or the system path. When HCDownloader runs, it loads and executes the attacker's malicious file instead of the legitimate one, giving the attacker code execution in the context of the user running the application.