A zero-day vulnerability in INVT's VT-Designer and HMITool engineering software lets attackers run arbitrary code on industrial control system (ICS) workstations simply by tricking a user into opening a specially crafted project file, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed on August 26, 2025. The flaw is one of three high-severity issues outlined in a trio of ICS advisories that also cover Schneider Electric Modicon M340 controllers and Danfoss AK-SM 8xxA system managers, reinforcing an urgent need for patches, network segmentation, and strict file handling in operational technology (OT) environments.

The advisory bundle—ICSA-25-238-01 (INVT), ICSA-25-238-03 (Schneider Electric), and ICSA-25-140-03 Update A (Danfoss)—arrives as a timely reminder that engineering tools, PLC controllers, and system managers remain high-risk vectors. Attackers increasingly target the software used to design, configure, and manage industrial processes, where a single malicious file can cascade into broad compromise of factory floors, utilities, and critical infrastructure.

The Zero-Day in INVT Tools: Technical Details and Risk

The most urgent warning concerns INVT's VT-Designer and HMITool, popular applications for programming human-machine interfaces and PLCs. According to the Zero Day Initiative (ZDI) advisory ZDI-25-480, independently published on July 7, 2025, and now incorporated into CISA's advisory, the vulnerability stems from improper parsing of project files in the PM3 and VPM formats. When a user opens a malicious file—whether delivered via email, a compromised website, or USB drive—the application writes data past the end of a heap-allocated buffer, enabling remote code execution.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT VT-Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file," the ZDI advisory states. The flaw, classified as an out-of-bounds write (CWE-787), carries a CVSS v3 score of 7.8, indicating high impact but requiring user interaction. Because engineering workstations often run with elevated privileges and have direct network access to controllers, successful exploitation hands an attacker a potent beachhead into OT networks.

ZDI's disclosure timeline reveals a troubling pattern. The vulnerability was reported to the vendor on August 15, 2024, but after multiple follow-ups, no patch materialized. By March 2025, the case was submitted to ICS-CERT, which also struggled to reach INVT. On June 24, 2025, ZDI informed ICS-CERT of its intention to publish as a zero-day, leading to the July 7 public advisory. As of CISA's August 26 bundling, no vendor fix is available, leaving mitigation squarely on network controls and user education.

CVE mapping across public trackers shows some inconsistency. ZDI-25-480 is associated with CVE-2025-7224, while related parsing bugs in HMITool have been assigned CVE-2025-7223 and CVE-2025-7229 by other sources. CISA's advisory does not enumerate specific CVEs for the INVT issue, but operators should treat the class of vulnerability—memory corruption during file parsing—as the operative risk. Where exact CVE assignment varies, defenders should follow vendor and CISA guidance first and supplement with authoritative trackers.

Schneider Electric Modicon M340: Message Integrity and Authentication Flaws

CISA's second advisory, ICSA-25-238-03, turns the spotlight on Schneider Electric's Modicon M340 programmable logic controllers and associated MC80 communication modules. These devices are ubiquitous in manufacturing and utility automation, making the vulnerabilities particularly concerning. The advisory builds on earlier notifications (ICSA-24-326-03 and Schneider's SEVD-2025-014-05) and highlights issues with message integrity enforcement, authentication bypass via spoofing, and memory-handling defects in webserver components.

Specifically, the flaws could allow a network-based attacker to manipulate communication between engineering software and controllers. By inserting themselves into a Modbus TCP session or targeting the controller's web interface, adversaries could steal password hashes, upload unauthorized project logic, or trigger denial-of-service conditions. Some vulnerabilities, such as CVE-2024-8933, carry CVSS v4 scores above 7.7 and are exploitable remotely under certain configurations.

Schneider Electric has published firmware updates for specific CPU and communication module versions, but not all devices have fixes available yet. CISA and Schneider both stress immediate compensating controls: block Modbus/TCP port 502 at network boundaries, disable unused web servers on controllers, secure engineering workstation access with strict ACLs, and apply available patches during planned maintenance windows. As with many ICS devices, the operational reality is that firmware updates often lag due to production uptime requirements, so network segmentation becomes the first line of defense.

Danfoss AK-SM 8xxA: Predictable Password Generation Bypass

The third advisory, an update to ICSA-25-140-03, concerns Danfoss AK-SM 8xxA Series system managers, which supervise refrigeration and HVAC systems in supermarkets, cold storage, and industrial facilities. The vulnerability, tracked as CVE-2025-41450, allows unauthenticated remote attackers to bypass authentication entirely. The flaw originates from a datetime-based password generation scheme that can be predicted, giving an attacker administrative access to the device's management interface.

Once in, an adversary could alter control logic, manipulate telemetry, or disrupt processes—consequences that could range from spoiled goods to safety incidents in large-scale refrigeration. Danfoss has released version R4.2 of the firmware to fix the issue, and CISA's update underscores that the vendor response is available. Still, operators are urged to isolate these system managers from untrusted networks, enforce strong authentication where possible, and monitor access logs for anomalies.

Cross-Cutting Analysis: Patterns and Operational Risks

These three advisories, while targeting different products, share common themes that have plagued ICS security for years. The INVT zero-day exemplifies the pernicious risk of engineering-file-based attacks. A single malicious PM3 file—potentially disguised as a legitimate project—can compromise an entire OT segment. Engineering workstations are often the weakest link: they run outdated operating systems, lack endpoint detection, and hold privileged connections to PLCs. The ZDI disclosure timeline further exposes the difficulties in patching niche industrial software; when vendors do not respond, defenders must rely on network controls and user behavior changes.

The Modicon M340 advisory highlights the fragility of legacy protocols. Modbus, designed well before modern authentication and encryption standards, remains foundational. Vendors have layered web interfaces and proprietary security on top, but fundamental flaws persist. Message integrity bypasses and authentication spoofing attacks thrive in flat OT networks where engineering traffic mingles with production data.

Danfoss's datetime-based password problem is a textbook case of "security through obscurity" gone wrong. Predictable credential generation is a well-understood anti-pattern, yet it still surfaces in embedded devices. The advisory update is welcome, but the incident reinforces the need for independent code audits and secure development lifecycles in OT vendors.

A persistent tension in ICS environments is the patch-versus-operability trade-off. Updating firmware on a running PLC or system manager can mean halting production. Many sites delay patches for months or years, instead depending on compensating controls. While effective when rigorously implemented, these controls—network segmentation, jump hosts, file quarantining—often degrade over time or are misconfigured. The community analysis accompanying these CISA advisories rightly emphasizes rigorous patch validation policies and documented risk acceptance procedures.

Mitigation Strategies for ICS Defenders

The combined guidance from CISA, ZDI, Schneider, and Danfoss points to a layered defense that prioritizes immediacy and practicality. OT administrators should action the following checklist within 72 hours:

  • Inventory and prioritize: Compile an authoritative list of engineering workstations with VT-Designer/HMITool installed, all Modicon M340 CPUs and modules, and any AK-SM 8xxA system managers. Document firmware versions and network exposure.
  • Apply vendor fixes where available: For Danfoss devices, upgrade to R4.2. For Schneider Modicon, consult SEVD-2025-014-05 and apply applicable firmware updates during planned outages.
  • Isolate and segment: For all products, enforce strict network segmentation. Block Modbus/TCP port 502 and controller web ports (80/443) at firewalls. Place engineering workstations in a dedicated management network segment with tight ACLs.
  • Harden file handling: Quarantine all project files received externally. Use dedicated, patched virtual machines for opening untrusted files. Disable auto-opening of project files from email or links.
  • Strengthen authentication and monitoring: Replace default passwords, disable predictable generation schemes, and enable centralized logging for authentication events, configuration changes, and project uploads.
  • Use least privilege: Run engineering tools under standard user accounts, not administrator. Implement application allowlisting on engineering workstations.
  • Prepare for long-term maintenance: Where patches are not yet available (as with INVT), document risk acceptance, compensating controls, and monitoring plans. Subscribe to vendor security notifications to track remediation progress.

These steps mirror CISA's broader ICS mitigation recommendations and community-driven best practices. They recognize that in many plants, patching is not immediate; compensating controls buy critical time.

Where Caution Is Needed

Several aspects of these advisories require careful interpretation. For the INVT vulnerability, the lack of a vendor patch means the zero-day status persists. CISA's advisory does not cite public exploitation, but the availability of technical details in the ZDI bulletin raises the likelihood of proof-of-concept development. Operators should not interpret the absence of known attacks as safety.

CVE mapping inconsistencies across ZDI, NVD, and CISA for the INVT parsing bugs can cause confusion during vulnerability scanning. When asset management tools flag a specific CVE, cross-reference with ZDI's advisory and the actual affected version rather than relying on a single identifier.

For Schneider, some fixes remain on the vendor roadmap. A device marked "fixed in future release" in a security document remains vulnerable until that release is installed. Controllers often run for years without updates, so check advisory dates—older advisories may not reflect the latest firmware availability.

Danfoss's R4.2 is a definitive fix for CVE-2025-41450, but the advisory does not cover other potential weaknesses in the same product line. Treat this as a point solution, not blanket assurance.

The Strategic Takeaway

CISA's August 26 advisories encapsulate the daily reality for ICS defenders: a mix of newly discovered zero-days, known-but-unpatched flaws, and vendor-resolved issues that have not been deployed. The attack pathways—malicious project files, network-based manipulation of controller traffic, predictable authentication—are well-established, yet they continue to succeed because operational constraints slow remediation.

For ICS operators, urgency must be balanced with operational safety. The immediate priorities are clear: isolate engineering workstations, segment networks, and enforce strict file hygiene. For products with available patches, schedule installations. For those without, harden the surrounding infrastructure and monitor for signs of compromise.

The INVT zero-day serves as a stark illustration of what happens when vendors go silent. Defenders cannot rely solely on vendor outreach; they must assume that any tool with network or file access is a potential vector and architect networks accordingly. As OT environments increasingly connect to IT and cloud services, the blast radius of a compromised engineering workstation only grows.

Review the full advisory set: CISA Alerts (August 26, 2025), ZDI-25-480, Schneider Electric SEVD-2025-014-05, and Danfoss Security Advisory. Each contains detailed version applicability and step-by-step hardening guidance. The time to act is now—before a malicious project file lands in an engineer's inbox.