CVE-2025-7223: INVT HMITool VPM File Parsing RCE Flaw

CVE-2025-7223 Overview

CVE-2025-7223 is an out-of-bounds write vulnerability in INVT HMITool, a configuration utility used with INVT human-machine interface (HMI) devices. The flaw resides in the parser that handles VPM project files. Attackers can craft a malicious VPM file that, once opened by a local user, writes data past the end of an allocated buffer. Successful exploitation results in arbitrary code execution within the context of the HMITool process. The issue was reported through the Zero Day Initiative as ZDI-CAN-25044 and tracked in advisory ZDI-25-474. The vulnerability is classified under [CWE-787] Out-of-Bounds Write.

Critical Impact
A specially crafted VPM file can trigger arbitrary code execution on engineering workstations running INVT HMITool, providing a pivot point into operational technology environments.

Affected Products

INVT HMITool version 7.1.011
INVT HMI project engineering workstations using HMITool
Systems where users open or import third-party VPM project files

Discovery Timeline

2025-07-21 - CVE-2025-7223 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7223

Vulnerability Analysis

The vulnerability exists in INVT HMITool's parser for VPM project files. HMITool is the engineering software used to design HMI projects deployed to INVT operator panels. When HMITool processes a VPM file, the parser reads fields from the file and copies data into fixed-size buffers without correctly validating field lengths or offsets against buffer boundaries.

Because the parser trusts attacker-controllable values from the file, a crafted VPM file can cause the application to write attacker-supplied bytes outside the bounds of the destination buffer. Depending on the layout of adjacent memory, the write corrupts function pointers, return addresses, vtable entries, or other control structures used by HMITool. An attacker who controls the contents of the overflow can divert execution to attacker-controlled code.

Exploitation requires the user to open the malicious file or visit a page that delivers it. Code executes in the security context of the HMITool process, which typically runs as the engineer working with the project file. From an interactive workstation, this provides a foothold suitable for lateral movement toward HMI panels and PLCs.

Root Cause

The root cause is improper validation of user-supplied length or offset fields read from the VPM file format. The parser performs a copy or write operation using these untrusted values, producing an out-of-bounds write [CWE-787]. No bounds check enforces that the destination remains within the allocated buffer.

Attack Vector

The attack is local and requires user interaction. An attacker delivers a weaponized VPM file through phishing email, a shared engineering drive, a USB device, or a web page hosting the file. When the engineer opens the file in HMITool, the parser triggers the out-of-bounds write and executes attacker-controlled code.

Technical exploitation details are described in the Zero Day Initiative advisory ZDI-25-474. No public proof-of-concept code is currently available.

Detection Methods for CVE-2025-7223

Indicators of Compromise

VPM files arriving from untrusted sources, especially via email attachments, shared drives, or removable media on engineering workstations
HMITool.exe (or related HMITool process) spawning child processes such as cmd.exe, powershell.exe, rundll32.exe, or regsvr32.exe
HMITool process performing outbound network connections to non-corporate destinations shortly after a project file is opened
Unexpected crashes or repeated crash dumps generated by HMITool, indicating attempted but failed exploitation

Detection Strategies

Monitor process ancestry on engineering workstations for HMITool spawning interpreters, scripting hosts, or living-off-the-land binaries
Inspect file write and execution events for new executables, DLLs, or scripts created by the HMITool process
Alert on VPM files originating from external email or web downloads and subsequently opened by HMITool

Monitoring Recommendations

Apply behavioral endpoint detection to OT engineering workstations, with telemetry forwarded to a central data lake for cross-host correlation
Track command-line arguments and module loads associated with HMITool to baseline normal usage and surface deviations
Correlate workstation alerts with subsequent authentication or traffic toward HMI panels and PLCs to identify lateral movement attempts

How to Mitigate CVE-2025-7223

Immediate Actions Required

Inventory all systems running INVT HMITool 7.1.011 and identify the engineers and workstations that use it
Restrict opening of VPM files to known, internally produced project files and block VPM attachments at the email gateway
Isolate HMITool engineering workstations from general-purpose internet browsing and email where feasible
Apply least-privilege principles so HMITool does not run with administrative rights on the workstation

Patch Information

At the time of publication, no vendor advisory or fixed version has been linked in the NVD entry for CVE-2025-7223. Consult INVT and the Zero Day Initiative advisory ZDI-25-474 for updates on a vendor patch and apply the fixed version as soon as it becomes available.

Workarounds

Treat all externally sourced VPM files as untrusted and validate them on an isolated, non-production analysis system before opening in HMITool
Use application allowlisting to restrict HMITool execution to authorized engineering workstations only
Disable file associations that automatically launch HMITool for VPM files to require explicit user action
Maintain offline backups of legitimate VPM project files to support recovery and integrity verification

bash

# Example: block .vpm attachments at an SMTP gateway (Postfix header_checks)
/^Content-(Disposition|Type).*name\s*=\s*"?[^"]*\.vpm"?/  REJECT VPM attachments are not permitted