Schneider Electric has patched a bug in IGSS that lets a malicious file take over the machine used to design SCADA control screens.
The flaw sits in the IGSS Definition module (Def.exe), the design-time tool engineers use to build mimic diagrams - the visual control panels plant staff use to monitor and operate industrial equipment. It's logged as an out-of-bounds write (CWE-787), the kind of memory-corruption bug that can corrupt data or let an attacker run arbitrary code. The flaw carries a CVSS score of 7.8, rated high severity, though exploiting it requires local access and a user to take an action - most likely opening or importing a file from an untrusted source. Schneider Electric and independent researcher Michael Heinzl both reported the issue, and a fix is available through the company's IGSS software update.
Def.exe isn't the software running the plant floor - it's the tool that builds what plant floor operators see. That makes it a soft target: compromise an engineer's design workstation, and the resulting mimic diagrams could ship tampered logic into environments that run power, water, or manufacturing systems. Attacks on ICS design tools are less flashy than attacks on the SCADA runtime itself but arguably more durable, since they poison what gets deployed rather than attacking it after the fact.
Schneider's own advice - don't open files from people you don't trust - is a reminder that in industrial control software, the weakest link is still often a design engineer double-clicking the wrong file.