Schneider Electric Pro-face GP-Pro EX

An attacker with access to the GP-Pro EX engineering workstation could inject malicious code that executes automatically when the application launches, potentially gaining control of operator interface logic and the devices it controls. This could allow manipulation of process setpoints, alarms, or shutdown commands affecting production or safety.

Energy sector organizations and utilities that use Schneider Electric Pro-face GP-Pro EX operator interface software for HMI/SCADA monitoring and control. Affects both engineering workstations used to build and modify interfaces and runtime systems that execute those interfaces. Particularly relevant for utilities managing critical process control workflows.

An attacker who has gained valid credentials for the GP-Pro EX engineering environment (or compromises an engineering workstation) modifies project code to inject a malicious executable. When an operator or engineer launches the GP-Pro EX application, the injected code runs with the privileges of the GP-Pro EX process, allowing command execution on the workstation and potential lateral movement to connected control devices.