Why HMIs Are a Consistent Weak Point
The Human-Machine Interface is the operator's window into the process. It's also, in most OT environments, one of the worst-secured devices on the network. The combination of old Windows versions, permissive local accounts, USB-accessible hardware, and occasional internet connectivity for vendor support creates a target that's more approachable than almost anything else in the OT environment.
That's not a new problem. What's changed is the threat landscape around it. HMIs that would once have been ignored by attackers — too obscure, too specialised, not worth the effort — are now reachable from ransomware campaigns, opportunistic intrusions, and targeted OT attacks. The risk calculus has shifted.
What Makes HMIs Soft Targets
The age of the underlying OS is the first issue. A significant number of production HMIs are still running Windows 7, Windows XP, or Windows Server 2008. These operating systems are past Microsoft's extended support end-of-life. They receive no security patches. Every CVE disclosed for those OS versions since end-of-life remains permanently unpatched.
The reason they're still running isn't negligence — it's the validation problem. SCADA and HMI software packages from Siemens, Rockwell, and Schneider are tested and validated against specific OS versions. When the vendor's qualification matrix says "WinCC V7.4 is supported on Windows 7 SP1," upgrading to Windows 10 may break the HMI application. The operator faces a choice between an unpatched-but-working HMI and a patching exercise that could take weeks of application re-testing and validation.
Most operators choose working.
The second issue is account management. HMIs are often set up with a single local account — frequently local administrator — that everyone who sits at the machine uses. There's no individual accountability, no way to audit who changed what, and that local admin account has full OS access. If malware executes in that context, it has full control.
Third: USB ports. SCADA operators use USB drives. They transfer trend data exports, configuration files, software installers. An HMI with open USB ports is a malware delivery vector. Stuxnet propagated via USB. So does most ransomware that enters OT environments.
Fourth: remote access for vendor support. It's operationally normal for the SCADA vendor to want remote access to the HMI to troubleshoot issues. This access is often implemented badly — a standing TeamViewer or AnyDesk installation, always-on, with a shared password. That's not a support channel; it's a permanent unlocked door.
Common Vulnerability Classes in HMI Software
Siemens WinCC, Rockwell FactoryTalk View SE/ME, and Schneider EcoStruxure Operator Terminal Expert all have advisory histories. The recurrent vulnerability classes are:
Authentication and authorisation issues — session tokens that can be forged, authentication that can be bypassed, privilege escalation from operator to administrator context. These appear regularly across all three platforms.
Buffer overflows in parsing code — vulnerability to malformed project files or communication data that triggers memory corruption. An attacker who can send crafted data to an HMI process can potentially achieve code execution.
Directory traversal in web components — many modern HMIs include web server functionality for remote viewing. These web interfaces have had path traversal and information disclosure issues.
Insecure communications — some older HMI configurations transmit credentials or session data unencrypted. Siemens has improved this in recent WinCC versions. Legacy deployments may still have insecure communication modes enabled.
Hardening Without Breaking the Application
The practical constraint is that hardening cannot break the SCADA application. Every change has to be tested. That's the reality of OT, and approaches that ignore it don't get implemented.
Here's what works within those constraints:
Network position first. The HMI should only be able to communicate with the SCADA server, the historian, and the PLCs it's monitoring. It should not have internet access, corporate network access, or the ability to initiate connections to anything outside those defined hosts. A VLAN with an ACL is sufficient for this. It doesn't require application changes.
User accounts without administrator rights. Create a separate operator account that has the permissions needed to run the SCADA application but not to install software or modify system configuration. Test the SCADA application under that account. For most modern versions of WinCC, FactoryTalk View, and EcoStruxure, a non-admin user account works.
USB control via Group Policy. Disable USB mass storage devices through Windows Group Policy or a dedicated endpoint control tool. Leave USB HID (keyboard, mouse) enabled. This is OS-level and doesn't affect the SCADA application.
Remove always-on remote access. Replace standing TeamViewer/AnyDesk installations with session-based access: the operator establishes the session when vendor support is needed, and it closes when support is complete. Log every session. This is operationally viable and dramatically reduces the standing attack surface.
OS patching via a test environment. The right approach for HMI patching is to maintain a test instance — a non-production HMI with the same software and configuration — where patches are validated before being applied to production. This is resource-intensive but it removes the "we can't patch because we don't know what it breaks" problem.
The Upgrade Decision
There comes a point where an HMI running Windows 7 has accumulated enough risk — unpatched vulnerabilities, unsupported application version, incompatibility with modern security tools — that the only realistic path is replacement. That decision is expensive and disruptive. It also doesn't go away by ignoring it.
If you have Windows 7 HMIs on your OT network, start the planning process now. Understand the SCADA software upgrade path, the hardware requirements, the process impact of the cutover. The vulnerability exposure accumulates every month you delay.
---
If you want advisory monitoring without the manual work, OTWarden monitors CISA, Siemens ProductCERT, Rockwell, Schneider, ABB, BSI, and more — filtered to your equipment watchlist. Start a free 14-day trial — no card required.