Schneider's New Bug Needs an Engineer to Open a File. We Spent This Week Documenting Controllers That Publish the Engineer's Name.
- Patrick Duggan
- 5 minutes ago
- 4 min read
CISA published ICSA-26-211-04 on 30 July: an out-of-bounds write in Schneider Electric IGSS, tracked as [CVE-2026-12927](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-12927). Importing a malicious CGF file into the IGSS Definition module can cause data loss or arbitrary code execution. Fixed in 18.0.0.26125. Reported by Schneider Electric and by Michael Heinzl.
If that sounds familiar, it should. On 26 July we wrote about four out-of-bounds writes in Rockwell Arena — CVE-2026-8085, 8312, 8313 and 8314 — where the trigger was opening a malicious simulation file. Our argument then was that the target is not the PLC but the engineer who programs it.
Six days later, different vendor, same defect class, same delivery, same tier.
And in between, we spent a week documenting something that makes both of them considerably easier to use.
The vector, and the one thing it still needs
Both vulnerabilities carry UI:R — user interaction required. Somebody has to open something. That is usually treated as a mitigating factor, and in isolation it is.
But it converts the attacker's problem into a targeting problem. A file-open bug in industrial engineering software is worthless unless you know who runs that software, on what machine, and which file format they will actually open without thinking.
That is a hard question about a stranger's organisation. Usually.
The controllers answer it
This week we measured 34 US industrial controllers that publish their project metadata to anyone who asks. Real responses, unauthenticated, returned on request:
WIN-BB892MB2CEH C:\USERS\ADMINISTRATOR\DESKTOP\SCH_CHANGED\01
BOOK-521J37KM6S C:\USERS\JORDE\ONEDRIVE\DOCUMENTS\UNITY...
JERRY-PC C:\USERS\PUBLIC\DOCUMENTS\SCHNEIDER ELECTRIC\UNITY...
Read what is in there. The engineering workstation's name. The operator's own username. The vendor software in use — those Unity and Schneider Electric paths tell you exactly which product wrote the project, and therefore exactly which file format that engineer opens as a matter of routine. And the directory where the projects live.
Twenty-one of the thirty-four name an owner, a site or an integrator. Several name a person.
That is the targeting package for a UI:R vulnerability, assembled from a device banner, for free, by anyone.
What I am not saying
Neither advisory reports exploitation. No campaign we are aware of has used controller disclosure to select spear-phishing targets. Nobody has connected these, and we are describing what the pieces make possible rather than something that has happened.
We have written that caveat three times this week and it keeps mattering. The failure mode in this field is assembling true facts into a proportion that is not there. So: this is a composition argument, not an incident report.
What makes it worth writing anyway is that every component is public, two of them arrived in the same fortnight, and three of them are in the same banner.
Why the advisory's own mitigation is thinner than it looks
Schneider's guidance for anyone not patching immediately is sensible and standard:
Avoid executing commands, importing or opening files from untrusted sources.
The trouble is what "untrusted" means in this job. A control-system engineer's working day is receiving project files from other people: the integrator, the OEM, the consultant doing the migration, the vendor proving their equipment hits spec. A CGF file arriving from a systems integrator is not suspicious. It is Tuesday.
And if the attacker has read your controller's banner, they know the integrator's workstation name and can write an email that sounds exactly like the last twelve you received.
"Don't open untrusted files" is only actionable when you can tell which ones those are.
What to actually do
Patch IGSS to 18.0.0.26125. Via IGSS Master → Update IGSS Software. No exploitation reported, which makes this the cheapest moment it will ever have. Same for Arena at 17.00.01 if you have not done it.
Then take the project path out of your controller's identification. This is the part nobody is telling you and it costs an afternoon. Ask your own device to identify itself from outside your perimeter — Modbus on 502, EtherNet/IP on 44818, S7comm on 102 — and read what comes back. If it returns a workstation name, a username or a file path, edit the project properties to a plain site name and reload.
You are not just leaking configuration. You are publishing which of your staff to email, and what to send them.
And treat engineering files like macro-enabled documents. Everyone learned this lesson with Office attachments and then quietly exempted every industrial file format from it. A .doe, a .CGF, a Unity project archive — untrusted input from outside your organisation, hitting a parser with a demonstrated memory-safety history, twice in six days.
The week's shape
Rockwell on the 26th. Schneider on the 30th. Both in the engineering tier, both needing a human to open a file. CISA's water alert on the 30th naming undocumented cellular modems as the exposure path. And thirty-four controllers quietly publishing the name of the laptop that programs them.
None of those were designed to fit together. They do anyway, and the piece that joins them is the one nobody is asking their controllers about.
Confidence capped at 95%. Advisory details are from ICSA-26-211-04 and Schneider Electric's own publication; Arena details from the July advisories and our 26 July coverage. Controller responses are passive third-party scan data read 31 July, anonymised to workstation level, no site or owner named — we sent no traffic to any host. No exploitation of either vulnerability is reported and no campaign has combined these; the composition argument is ours and is explicitly forward-looking.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments