Critical File Read Vulnerability in Valmet DNA Engineering Web Tools (ICSA-26-050-02)

Critical Vulnerability Disclosed in Valmet DNA Engineering Web Tools

The Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory (ICSA-26-050-02) detailing a severe vulnerability in Valmet DNA Engineering Web Tools, a software suite used for industrial control system (ICS) maintenance and engineering. Successful exploitation of this flaw could allow unauthenticated attackers to achieve arbitrary file read access by manipulating the web maintenance services URL.

Technical Details

• Affected Software: Valmet DNA Engineering Web Tools (specific versions not disclosed in the advisory)
• Vulnerability Type: Arbitrary file read via URL manipulation
• Attack Vector: Unauthenticated remote access
• Impact: Unauthorized access to sensitive files on the affected system
• CVE ID: Not explicitly assigned in the advisory (refer to CSAF document for further details)

The vulnerability stems from improper validation of user-supplied input in the web maintenance services URL. An attacker could craft malicious requests to bypass authentication and access files stored on the system, potentially exposing sensitive operational or configuration data.

Impact Analysis

Industrial environments relying on Valmet DNA Engineering Web Tools are at risk of data exfiltration and unauthorized system access. Given the software’s role in ICS maintenance, exploitation could lead to:

• Exposure of proprietary engineering diagrams or configurations
• Disclosure of credentials or access tokens stored in files
• Reconnaissance for further attacks on critical infrastructure

The unauthenticated nature of the vulnerability significantly increases the risk, as attackers do not require prior access or credentials to exploit it.

Recommendations

CISA urges organizations using Valmet DNA Engineering Web Tools to:

1. Review the CSAF advisory for technical mitigations and patches.
2. Restrict network access to the web maintenance services to trusted IP addresses or internal networks.
3. Monitor for suspicious activity, such as unusual file access patterns or unauthorized URL requests.
4. Apply vendor-supplied patches as soon as they become available.
5. Segment ICS networks to limit lateral movement in case of exploitation.

For further guidance, refer to CISA’s ICS Advisory (ICSA-26-050-02).