PT-2022-6571 · Icl · Icl Scadaflex Ii Scada Controller Sc-2+1

Published 2022-02-26 · Updated 2023-08-08 · CVE-2022-25359

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ICL ScadaFlex II SCADA Controller SC-1 and SC-2 version 1.03.07

Description The issue is related to the lack of an authentication procedure, allowing unauthenticated remote attackers to overwrite, delete, or create files on the device. This can enable a remote attacker to gain unauthorized access to the device.

Recommendations For ICL ScadaFlex II SCADA Controller SC-1 and SC-2 version 1.03.07, consider implementing authentication procedures to restrict access to the device and prevent unauthorized file modifications. As a temporary workaround, restrict remote access to the device until a patch is available.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

BDU:2023-02458

CVE-2022-25359

Affected Products

Icl Scadaflex Ii Scada Controller Sc-1

Icl Scadaflex Ii Scada Controller Sc-2

References · 9

• 🔥 https://packetstormsecurity.com/files/166103/ICL-ScadaFlex-II-SCADA-Controllers-SC-1-SC-2-1.03.07-Remote-File-Modification.html · Exploit
• 🔥 https://exploit-db.com/exploits/50783 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25359 · Security Note
• http://files.iclinks.com/datasheets/Scadaflex%20II/Scadaflex%20SC-1%20&%20SC-2_A1_compressed.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02458 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25359 · Vendor Advisory
• https://t.me/cvenotify/27898 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-096-01 · Note
• http://files.iclinks.com/datasheets/Scadaflex%20II/Scadaflex%20SC-1%20&%20SC-2_A1_compressed.pdf · Note