PEPPERL+FUCHS VisuNet RM, VisuNet PC, and Box Thin Client

An attacker on the same network segment could intercept communications between HMI devices and clients, gain administrative access, and execute commands on plant visualization and control systems. This could allow alteration of displayed process data, modification of device configurations, or disruption of operator visibility into plant operations.

Water and electric utilities operating Pepperl+Fuchs VisuNet RM, VisuNet PC, or Box Thin Client (BTC) HMI devices should be concerned. These devices are used for process visualization and control in SCADA and industrial automation environments. Operators and engineers accessing these HMI systems are at risk of credential interception and system compromise if their devices run affected versions of RM Shell 4, RM Shell 5, Windows 7, or Windows 10 without the latest security patches.

An attacker with network access to the same segment as an HMI device can intercept CredSSP protocol communications during authentication. By exploiting encryption oracle weaknesses, the attacker can extract credentials or establish a man-in-the-middle position. This grants administrative access to the device, enabling remote code execution and full system compromise. The attack requires the attacker to be positioned on the network path between the HMI device and its clients (e.g., same plant network, VPN, or compromised intermediate system).