cscript.exe hijack

The cscript.exe hijack tag covers discussions about privilege escalation attacks that abuse Windows Script Host's cscript.exe process, particularly in industrial control system (ICS) environments. A highlighted vulnerability is CVE-2025-7973 in Rockwell Automation's FactoryTalk ViewPoint, where a local attacker can escalate to SYSTEM privileges by exploiting Windows MSI repair behavior. This attack vector involves hijacking cscript.exe to execute malicious scripts with elevated permissions. The tag focuses on security advisories, CVSS scores, and mitigation steps for such hijack techniques, emphasizing the need for patching and vendor-recommended defenses in Windows-based ICS deployments.