CVE-2012-4709: Invensys Wonderware InTouch HMI 2012 R2 and earlier allows remote attackers to read arbitrary files, send H...

Security readout for executives and security teams

This issue affects Invensys Wonderware InTouch HMI 2012 R2 and earlier. A remote attacker could abuse XML handling to read files, trigger requests into internal systems, or consume CPU and memory. The public bundle does not provide CVSS, patch details, or evidence of active exploitation. Exposure is most likely where Wonderware InTouch HMI 2012 R2 or earlier accepts XML input from reachable networks. Internet exposure would raise urgency, but the bundle does not confirm typical deployment paths or affected interfaces. Treat as high priority for industrial environments because the impact includes file disclosure, internal request abuse, and denial of service against HMI software. Prioritize inventory and exposure reduction first, then validate vendor remediation. Mitigation focus: Identify any Wonderware InTouch HMI 2012 R2 or earlier deployments.; Review the referenced ICS-CERT and vendor guidance for supported patches or workarounds.; Restrict network access to HMI components that accept XML input..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.