← Advisories

ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 Remote File CRUD

High
Advisory ID
ZSL-2022-5698
Release Date
22 February 2022
Vendor
Industrial Control Links, Inc. - http://www.iclinks.com
Affected Version
SW: 1.03.07 (build 317), WebLib: 1.24, SW: 1.02.20 (build 286), WebLib: 1.24, SW: 1.02.15 (build 286), WebLib: 1.22, SW: 1.02.01 (build 229), WebLib: 1.16, SW: 1.01.14 (build 172), WebLib: 1.14, SW: 1.01.01 (build 2149), WebLib: 1.13
Tested On
SCADA HTTP Server
Summary

Scadaflex II controllers are 100% web based for both configuration and user interface. No applications are required other than any standard web browser. They are easily supported by remote access over the Internet or a cellular link. Scadaflex II controllers support industry standard wired communications using Modbus, DF1, SNP, and Ethernet IP protocols along with Ethernet-Serial bridging for Modbus or any other protocol. Each Scadaflex II controller has both analog and digital, inputs and outputs, sufficient for pumping stations, irrigation controls, and other similar process monitoring and control applications. They can also serve as communications concentrators and protocol converters that enhance the operation of existing PLCs and process equipment.

Description

The SCADA controller is vulnerable to unauthenticated file write/overwrite and delete vulnerability. This allows an attacker to execute critical file CRUD operations on the device that can potentially allow system access and impact availability.

Proof of Concept
Disclosure Timeline
06.11.2021Vulnerability discovered.
16.01.2022Vendor contacted.
21.02.2022No response from the vendor.
22.02.2022Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
22.02.2022Initial release
23.02.2022Added reference [5], [6] and [7]
05.03.2022Added reference [8]
10.04.2023Added reference [9]
28.03.2024Added reference [10]