This vulnerability arises from improper neutralization of directives in dynamically evaluated code within the CONPROSYS HMI System (CHS). Specifically, the system evaluates code dynamically without adequately sanitizing input, leading to an 'Eval Injection' flaw. Exploitation requires an attacker to have login privileges to the product, after which arbitrary code execution is possible. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the affected system, potentially leading to full compromise of the CONPROSYS HMI System. This can result in unauthorized control, data manipulation, or denial of service affecting the system's confidentiality, integrity, and availability.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict login access to trusted users only and monitor for suspicious activity related to code evaluation features.