Horner Automation Cscape

An attacker with local access to a Cscape engineering workstation could execute arbitrary code with the privileges of the logged-in user, potentially allowing them to modify control logic, create backdoors, or alter process parameters.

Engineering teams and automation technicians at utilities, water systems, and industrial facilities who use Horner Automation Cscape software to design, program, and maintain industrial control logic. This affects anyone who develops or modifies configuration on Horner PLCs and other Horner devices through Cscape.

An attacker must first gain local file system access to a machine running Cscape (via malware delivery, social engineering, or physical access). The attacker then exploits a memory corruption vulnerability (CWE-121 buffer overflow) to execute arbitrary code when a legitimate user opens a specially crafted file in Cscape. No network connectivity to the PLC is required for the exploit itself, but the attacker could use the compromised workstation to access the industrial network afterward.