We have some equipment that is linked to PC's. These PC's acquire data from the equipment that they send to a server through an internal network. Furthermore these PC's are used to mediate instructions from network coupled PC's to the equipment. Therefore, they are named acquisition servers. The equipment has no standalone storage drive and only consists of PCBs (printed circuit boards).
There are flash chips present which stores the firmware. And yes, the equipment can write files on the PC containing data like serial number and so on. I actually do not know if it extends further. The equipment only has connection to the network through the acquisition server.
Every once in a while the equipment needs repair. In the past, the external technicians performing the repair just cut the connection to the acquisition servers and put the network cable from the equipment in their own PC's to be able to control the equipment locally.
Now, my local IT security says that we are not allowed to have external technicians coupling their own PC's directly to the equipment. They fear that a virus will infect the PCB's of the equipment and that the infection will be able to spread back to the acquisition server once it is coupled back again. All of the acquisition servers have state-of-the-art antivirus and firewall.
What do you think the risk is that an infection will go from PC to a print board and then back to a PC if any?