Horner Automation Cscape

An attacker with local access to an engineering workstation running Cscape could crash the application, read sensitive project files, or execute arbitrary code on the workstation, potentially compromising automation system configurations and credentials.

Automation engineers and operators managing Horner Automation programmable logic controllers (PLCs) and motion controllers via Cscape software. This affects engineering departments at manufacturing facilities, water treatment plants, HVAC systems, and any facility using Horner Automation equipment for process control.

An attacker must first gain local access to a workstation running Cscape (e.g., through social engineering, malware delivery, or physical access). The attacker then opens a specially crafted file or provides malicious input that triggers an improper input validation flaw. This causes the application to crash, allowing information disclosure, or in worse cases, the attacker gains code execution within the Cscape process running on that workstation.