Schneider Electric Triconex Tricon
System calls read directly from memory addresses within the control program area without any verification.  Manipulating this data could allow attacker data to be copied anywhere within memory. When a system call is made, registers are stored to a fixed memory location. Modifying the data in this location could allow attackers to gain supervisor-level access and control system states.