Siemens HyperLynx and Industrial Edge App Publisher

An attacker could trick a user into clicking a malicious link or opening a crafted HTML page, leading to arbitrary code execution on HyperLynx or Industrial Edge App Publisher systems. This could allow an attacker to run commands on the affected device and potentially alter industrial operations or steal sensitive data.

Manufacturing organizations using Siemens HyperLynx (an industrial circuit analysis and simulation tool used by design engineers) and Siemens Industrial Edge App Publisher (used to develop and deploy edge computing applications) should assess their exposure. HyperLynx is typically used on engineering workstations; Industrial Edge App Publisher runs on edge computing infrastructure. Both are at risk if accessible from untrusted networks or if users are targeted with social engineering.

The vulnerability is in Google Chrome's type confusion handling. An attacker crafts a malicious HTML page and tricks a user into opening it (via phishing, social engineering, or watering hole attack). When the user's browser renders the page, the type confusion flaw allows the attacker's code to execute with the privileges of the HyperLynx or Industrial Edge App Publisher application.