INVT VT-Designer and HMITool arbitrary code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Nine out-of-bounds write and type confusion flaws in INVT industrial software allow arbitrary code execution when users open malicious files.
CISA has published an advisory covering nine memory safety vulnerabilities affecting INVT VT-Designer (version 2.1.13) and HMITool (version 7.1.011), both used in industrial control systems across critical infrastructure sectors including energy, manufacturing, and transportation. The vulnerabilities stem from insufficient validation of user-supplied data in VPM file parsing (HMITool) and PM3 file parsing (VT-Designer), leading to out-of-bounds writes and type confusion that permit arbitrary code execution within the application's process context. All nine CVEs carry a CVSS v4 score of 8.5 with low attack complexity; exploitation requires user interaction (opening a malicious file or visiting a malicious page). No public exploitation has been reported. INVT did not respond to CISA's coordination attempts, and patched versions are not mentioned; CISA recommends network isolation, restricting Internet accessibility to control systems, and deployment behind firewalls to minimize attack surface.
Mentioned in this report
Detection guidance
INVT VT-Designer or HMITool Spawning Shell or Script Interpreter
VT-Designer or HMITool spawning a command shell, script host or LOLBin, which is consistent with code execution after a malicious PM3/VPM file is opened. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: INVT VT-Designer or HMITool Spawning Shell or Script Interpreter
description: Detects INVT VT-Designer or HMITool spawning a command shell, script
host or common LOLBin. The advisory describes memory-corruption flaws in PM3/VPM
file parsing that give code execution in the application process, so a child process
like this is a strong post-exploitation sign. The executable names are assumed from
the product names, so tune them to your environment.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- VT-Designer
- VTDesigner
- HMITool
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection_parent and selection_child
falsepositives:
- Engineering workflows or plugins that call cmd.exe from the HMI programming software
for build or export tasks
- Vendor installer or updater helpers launched from the application
level: high
id: 19356422-b931-540b-b054-5e6fcd762343
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-238-01
INVT VT-Designer or HMITool Opening Project File From Download or Temp Location
VT-Designer or HMITool launched with a PM3/VPM project file from a browser download, email cache or temp folder, the user-interaction path for the file-parsing vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: INVT VT-Designer or HMITool Opening Project File From Download or Temp Location
description: Detects VT-Designer or HMITool started with a .pm3 or .vpm file located
in a download, temp or email-attachment cache path. The advisory says exploitation
needs a user to open a malicious project file, so this surfaces untrusted-origin
files being opened. It is a context rule for triage and should be correlated with
child-process activity.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|contains:
- VT-Designer
- VTDesigner
- HMITool
selection_file:
CommandLine|contains:
- .pm3
- .vpm
selection_path:
CommandLine|contains:
- \Downloads\
- \AppData\Local\Temp\
- \Content.Outlook\
- \INetCache\
condition: all of selection_*
falsepositives:
- Engineers opening project files received from vendors or integrators and saved to
the Downloads folder
- Project files extracted from a zip archive to a temp directory for review
level: low
id: cae72107-b2f2-5c12-b25b-bb85cdaac361
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-238-01
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-238-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,571 reports from 145 sources, 595 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs