CVE-2023-7206 is a stack-based buffer overflow in Horner Automation Cscape, the programming software for Horner controllers. It scores 7.8 (High). A user opening a malicious CSP file can trigger code execution. Horner recommends version 9.90 SP11 or the latest release.
What's affected
Affected: Cscape 9.90 SP10 and prior, per the CISA advisory ICSA-24-011-04 and the record. Fixed: Horner recommends 9.90 SP11 or the latest version.
The attack is local and needs user interaction. The vector is AV:L/AC:L/PR:N/UI:R, so a person must open a crafted CSP project file. The weaknesses are CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write). CISA lists the sector as critical manufacturing and says the researcher reported it to CISA. The record shows KEV false, and the advisory does not describe exploitation in the wild.
Note that Horner's software page now lists Cscape 10 as the current line, with 9.9 still offered during the transition.
How to check if you're exposed
Check the installed version on each engineering workstation. On Windows, open Settings, then Apps, and read the Cscape version, or use the About screen inside Cscape. Anything at 9.90 SP10 or earlier is affected.
Also inventory where CSP project files come from. Files received by email, shared drives or from contractors are the delivery route for this flaw.
What to do now
- Update Cscape to 9.90 SP11 or the latest version from Horner. Downloads require a registered account on the vendor site.
- Do not open CSP files from sources you do not trust, and confirm unexpected project files with the sender by another channel.
- Keep control system networks off the internet and behind firewalls, as CISA advises.
- Limit engineering workstations to the accounts and tools that need them, so a code execution bug lands with few rights.
Why it matters
A stack buffer overflow happens when a program copies more data into a fixed size memory area than it can hold, overwriting nearby memory. In a file parser, the attacker controls the data, so a crafted file can steer the program. The result here is arbitrary code execution as the user running Cscape.
Engineering workstations deserve extra care. They hold the project files that program real equipment, and they often sit close to the control network. Compromising one can be a step toward the plant floor.
Quick check
Can this be exploited remotely over the network?
Not directly. The vector is local, and a user has to open a malicious CSP file. The risk comes from how files reach engineers.
What version fixes CVE-2023-7206?
Horner recommends 9.90 SP11 or the latest Cscape version.
Sources
Last reviewed: 19 October 2026.
