Rare SCADA vulnerability discovered

The vulnerable software component, Wonderware SuiteLink, is used to help facilitate communications over TCP/IP networks for SCADA (supervisory control and data acquisition) systems, according to an advisory from Core Security Technologies, which discovered the flaw.

The vulnerability, first reported to Wonderware in January, could permit remote attackers to connect to the SuiteLink TCP port and send malicious packets, thus causing a denial-of-service, according to the advisory.

According to the National Vulnerability Database, the flaw earns a 7.5 CVSS score (out of 10). A successful exploit could permit unauthorised access, information disclosure and service disruption.

Representatives from Wonderware did not respond to a request seeking comment. However, according to Core, the company has issued a technical document, guiding affected users on how to remedy the issue.

Paul Ferguson, advanced threat researcher at Trend Micro, told SCMagazineUS.com on Thursday that this is the first publicly reported SCADA vulnerability that he is aware of. More, though, are sure to come as these systems becoming increasingly connected to the internet and become reliant on common operating platforms, he added.

"It used to be that SCADA control systems, most of them were all [based on] proprietary protocols and any type of problems that they had were usually taken care of and weren't really publicly known," he said.

"What's happened over the course of the past 10 years...these systems are falling prey to the same types of vulnerabilites that the enterprise commercial software industry is finding as well."

According to Wonderware, it has sold more than 500,000 software licenses to 100,000 plants worldwide. Customers include oil and gas, food and beverage, utilities, pharmaceuticals, electronics, metals and automotive.

discoveredrarescadasecurityvulnerability