CVE-2026-30512: Scheidt & Bachmann Entevo HMI vulnerability
A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlying Windows operating system. An authenticated low-privileged user can escape the kiosk environment by opening the application manual in the external PDF viewer and abusing the print functionality. Successful exploitation allows execution of arbitrary commands outside the kiosk environment with local administrator privileges.
Other sources
A local privilege escalation vulnerability in Entevo HMI V2 R5 P0 M4 allows attackers to escape Kiosk Mode by opening the application manual in an external PDF viewer and abusing the Print functionality to access Windows Explorer and execute arbitrary commands with administrative privileges.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Scheidt & Bachmann entervo HMI (Restricted Access (Kiosk) Mode)to a version that resolves this vulnerability.Fixed in V2 R5 P0 M5 - Upgrade
Upgrade
Entevo HMIto a version that resolves this vulnerability.Fixed in V2 R5 P0 M5 - Compensating control
Mitigate by restricting access/usage of the external PDF viewer functionality (used to display the application manual) and its Print workflow so kiosk users cannot open the manual in an external PDF viewer or abuse printing to interact with Windows Explorer and execute commands.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs local access to an affected Entevo HMI installation and must be able to interact with the kiosk application. Exploitation begins by opening the application manual.
How does the kiosk escape lead to administrative command execution?
The application manual is opened in an external PDF viewer. The viewer's Print functionality can be abused to reach Windows Explorer, from which arbitrary commands can be executed with administrative privileges.
Is a default installation affected?
The provided information identifies Entevo HMI V2 R5 P0 M4 as affected, but does not state whether the vulnerable kiosk configuration is enabled by default or whether a particular PDF viewer configuration is required.