Valmet DNA Engineering Web Tools

An attacker could read arbitrary files from the Valmet DNA engineering workstation, potentially exposing sensitive process configurations, engineering data, or credentials used to manage plant systems. This could lead to further compromise of your automation infrastructure.

This affects organizations using Valmet DNA Engineering Web Tools (version C2022 and earlier) for engineering and configuration of Valmet automation and process control systems. The risk is highest for utilities and manufacturing facilities that rely on Valmet systems for critical process control and where engineering workstations have network connectivity.

An attacker with network access to the Valmet DNA Engineering Web Tools web interface can craft a malicious URL with path traversal sequences (such as ../ or encoded variants) in the web maintenance services parameter. This bypasses file access restrictions and allows the attacker to read any file the web service process has access to, such as configuration files or system data.