Valmet DNA Engineering Web Tools

An attacker could read sensitive files from the engineering workstation running DNA Engineering Web Tools, potentially exposing engineering configurations, credentials, or system information that could be used to compromise process automation.

Any organization using Valmet DNA Engineering Web Tools for industrial process automation configuration and maintenance should assess this issue. The vulnerability affects engineering workstations and web-accessible maintenance interfaces in plants using Valmet automation systems, including paper mills, power plants, and other process industries.

An attacker with network access to the web maintenance service port can craft a malicious URL with path traversal sequences (../ characters) to bypass directory restrictions and read files outside the intended directory. No authentication is required. The attacker sends the crafted request to the web service and receives the file contents in the response.