RONDS Equipment Predictive Maintenance Solution

An attacker could steal credentials for maintenance and monitoring systems, then use those credentials to execute commands on the EPM platform or connected industrial equipment. This could disrupt predictive maintenance operations, compromise sensor integrity, or enable lateral movement into your control network.

Organizations operating RONDS Equipment Predictive Maintenance (EPM) software for predictive monitoring and maintenance of industrial equipment. Primarily affects utility operators, manufacturing facilities, and critical infrastructure using this condition-based maintenance platform. The vulnerability impacts any deployment of EPM v1.19.5 connected to networks.

An attacker with network access to the EPM interface can exploit information disclosure and path traversal vulnerabilities to extract login credentials and arbitrary files from the system. With obtained credentials, the attacker can log in as a legitimate user and execute remote code on the EPM system or connected devices, potentially altering sensor data, maintenance schedules, or downstream control system commands.