Critical Infrastructure Security, Incident Response, Patch/Configuration Management, TDR, Vulnerability Management

Rare SCADA vulnerability discovered

Updated Friday, May 9 at 4:53 p.m. EST

Researchers have discovered a rare bug in a Windows-based control software packageused by as many as one-third of the world's industrial plants.

The vulnerable software component, Wonderware SuiteLink, is used tohelp facilitate communications over TCP/IP networks for SCADA (supervisory control and dataacquisition) systems,according to an advisory from Core Security Technologies, whichdiscovered the flaw.

The vulnerability, first reported to Wonderware in January, could permit remote attackers to connect to the SuiteLinkTCP port and send malicious packets, thus causing a denial-of-service,according to the advisory.

According to the National Vulnerability Database, the flaw earns a 7.5CVSS score (out of 10). A successful exploit could permit unauthorizedaccess, information disclosure and service disruption.

A Wonderware spokeswoman said the company issued a technical alert to solution and support providers, guiding them on how to remedy the issue. She said the flaw can only be exploited by a malevolent insider.

"Wonderware is not aware of any customer or installation that has been affected by this issue," the spokeswoman said. "This vulnerability...can only be exploited by a deliberate malicious attack from within an organization by someone with access to the industrial network."

Paul Ferguson, advanced threat researcher at Trend Micro, toldSCMagazineUS.com on Thursday that this is the first publicly reportedSCADA vulnerability that he is aware of. More, though, are sure to comeas these systems becoming increasingly connected to the internet andbecome reliant on common operating platforms, he added.

"It used to be that SCADA control systems, most of them were all [basedon] proprietary protocols and any type of problems that they had were usually taken care of and weren't really publicly known," he said."What's happened over the course of the past 10 years...these systems are falling prey to the same types ofvulnerabilites that the enterprise commercial software industry isfinding as well."

According to Wonderware, it has sold more than 500,000 software licenses to 100,000 plants worldwide. Customers include oil and gas, food and beverage, utilities, pharmaceuticals, electronics, metals and automotive.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.