CVE-2026-30512: Scheidt & Bachmann entervo HMI Privilege Escalation

CVE-2026-30512 Overview

CVE-2026-30512 is a local privilege escalation vulnerability in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The flaw resides in the external PDF viewer used to display the application manual and its interaction with the underlying Windows operating system. An authenticated low-privileged user can escape the kiosk environment by opening the manual in the external PDF viewer and abusing its print functionality. Successful exploitation grants execution of arbitrary commands outside the kiosk with local administrator privileges. The weakness is categorized as [CWE-250] Execution with Unnecessary Privileges.

Critical Impact
A kiosk-confined user can break out of Restricted Access Mode and execute arbitrary commands as a local administrator on the underlying Windows host.

Affected Products

Scheidt & Bachmann entervo HMI versions prior to V2 R5 P0 M5
Windows-based deployments running the entervo HMI kiosk interface
Installations invoking the external PDF viewer for the embedded application manual

Discovery Timeline

2026-08-24 - CVE-2026-30512 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-30512

Vulnerability Analysis

The entervo HMI Restricted Access (Kiosk) Mode is designed to constrain interactive users to a limited application surface on a Windows host. To display the built-in application manual, the kiosk invokes an external PDF viewer. That viewer inherits the elevated context required by the parent process and exposes standard Windows dialogs, including the print dialog.

By invoking the print dialog from within the PDF viewer, an authenticated low-privileged operator can pivot to file system browsers, shell handlers, and arbitrary command execution outside the kiosk chrome. Because the calling process runs with local administrator rights, any command spawned through the escape chain inherits those privileges.

The attack requires only local, authenticated access with low privileges and no user interaction beyond the attacker's own actions. Impact spans confidentiality, integrity, and availability of the host.

Root Cause

The root cause is a violation of least privilege ([CWE-250]). The kiosk launches an external PDF viewer under a highly privileged account and fails to strip GUI subprocesses of file dialogs, shell integration, and print-to-file handlers. The kiosk boundary is enforced only at the application shell layer, not at the OS process token level.

Attack Vector

An attacker with interactive access to a locked-down entervo HMI terminal opens the application manual, which spawns the external PDF viewer. The attacker triggers the print dialog and uses the resulting Windows common dialog to browse the file system, launch a command interpreter, or execute an attacker-supplied binary. Detailed reproduction steps are documented in the GitHub Gist PoC and the TÜV Security Weakness Landing Page.

Detection Methods for CVE-2026-30512

Indicators of Compromise

Child processes of the entervo HMI executable or its PDF viewer that are not part of the documented application flow, such as cmd.exe, powershell.exe, or explorer.exe.
Windows print spooler or common dialog activity originating from the kiosk session outside authorized maintenance windows.
Creation or modification of files in system directories by the account running the kiosk shell.

Detection Strategies

Monitor process ancestry on entervo HMI hosts and alert on any interactive shell or scripting host spawned by the PDF viewer.
Correlate Windows Security event ID 4688 (process creation) with the kiosk service account to surface unexpected binaries.
Baseline legitimate application manual usage and flag prolonged PDF viewer sessions or repeated print dialog invocations.

Monitoring Recommendations

Ship Sysmon process, image load, and file creation telemetry from entervo HMI terminals to a central analytics platform.
Enable command-line auditing and PowerShell script block logging on all Windows kiosk hosts.
Review authentication logs for the low-privileged kiosk account to detect lateral use of credentials obtained after escape.

How to Mitigate CVE-2026-30512

Immediate Actions Required

Upgrade Scheidt & Bachmann entervo HMI to V2 R5 P0 M5 or later on all kiosk terminals.
Restrict physical and remote access to entervo HMI terminals until the patch is applied.
Rotate credentials for any local administrator accounts used to launch the kiosk shell.

Patch Information

Scheidt & Bachmann addresses the vulnerability in entervo HMI V2 R5 P0 M5. Consult the vendor advisory referenced from the TÜV Security Weakness Landing Page for release artifacts and deployment guidance.

Workarounds

Disable or remove the external PDF viewer used to render the application manual until the patched build is deployed.
Run the kiosk shell under a dedicated non-administrative Windows account and reserve administrative operations for a separate maintenance session.
Apply Windows AppLocker or Windows Defender Application Control policies that block cmd.exe, powershell.exe, and unauthorized binaries from executing under the kiosk account.

bash

# Example AppLocker policy stub to block shell breakout from the kiosk account
# Save as AppLockerPolicy.xml and import with Set-AppLockerPolicy
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="Enabled">
    <FilePathRule Id="block-cmd" Name="Block cmd.exe" Action="Deny" UserOrGroupSid="S-1-5-32-545">
      <Conditions>
        <FilePathCondition Path="%SYSTEM32%\cmd.exe" />
      </Conditions>
    </FilePathRule>
    <FilePathRule Id="block-ps" Name="Block powershell.exe" Action="Deny" UserOrGroupSid="S-1-5-32-545">
      <Conditions>
        <FilePathCondition Path="%SYSTEM32%\WindowsPowerShell\v1.0\powershell.exe" />
      </Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>