CVE-2022-25359
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to modify files on ICL ScadaFlex II SCADA controllers. Attackers can overwrite, delete, or create files without any authentication, potentially disrupting industrial control systems. This affects SC-1 and SC-2 controllers running version 1.03.07.
💻 Affected Systems
- ICL ScadaFlex II SCADA Controller SC-1
- ICL ScadaFlex II SCADA Controller SC-2
📦 What is this software?
Weblib by Iclinks
Weblib by Iclinks
Weblib by Iclinks
Weblib by Iclinks
Weblib by Iclinks
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to modify critical SCADA configuration files, disrupt industrial processes, cause physical damage, or establish persistent backdoors.
Likely Case
Unauthorized file modifications leading to service disruption, configuration changes, or data corruption affecting SCADA operations.
If Mitigated
Limited impact if controllers are isolated in air-gapped networks with strict access controls and file integrity monitoring.
🎯 Exploit Status
Public exploit details available on Packet Storm Security. Attack requires network access but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact ICL for firmware updates or replacement options.
🔧 Temporary Workarounds
Network Segmentation
allIsolate SCADA controllers in separate network segments with strict firewall rules
Access Control Lists
allImplement strict network ACLs to limit access to SCADA controllers to authorized systems only
🧯 If You Can't Patch
- Deploy network-based intrusion prevention systems (IPS) with rules to block exploitation attempts
- Implement strict network segmentation and zero-trust architecture principles
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial console. If version is 1.03.07, device is vulnerable.Check Version:
Check via web interface at http://[device-ip]/status or via serial console connectionVerify Fix Applied:
Verify firmware has been updated to a version later than 1.03.07 or device has been replaced.📡 Detection & Monitoring
Log Indicators:
- Unauthorized file modification attempts
- Unexpected file system changes
- Authentication bypass logs
Network Indicators:
- Unusual file transfer patterns to SCADA controllers
- Unauthorized access attempts to SCADA network segments
SIEM Query:
source_ip=* AND dest_ip=[scada_ip] AND (protocol=HTTP OR protocol=FTP) AND action=file_modify🔗 References
- http://files.iclinks.com/datasheets/Scadaflex%20II/Scadaflex%20SC-1%20&%20SC-2_A1_compressed.pdf
- https://packetstormsecurity.com/files/166103/ICL-ScadaFlex-II-SCADA-Controllers-SC-1-SC-2-1.03.07-Remote-File-Modification.html
- http://files.iclinks.com/datasheets/Scadaflex%20II/Scadaflex%20SC-1%20&%20SC-2_A1_compressed.pdf
- https://packetstormsecurity.com/files/166103/ICL-ScadaFlex-II-SCADA-Controllers-SC-1-SC-2-1.03.07-Remote-File-Modification.html
