The following are almost all the vulnerabilities I found for a quick experiment some months ago in certain well known server-side SCADA softwares still vulnerable in this moment. In case someone doesn't know SCADA (like me before the tests): it's just one or more softwares (usually a core, a graphical part and a database) that allow people to monitor and control the various hardware sensors and mechanisms located in industrial environments like nuclear plants, refineries, gas pipelines, airports and other less and more critical fields that go from the energy to the public infrastructures and obviously also the small "normal" industries. In technical terms the SCADA software is just the same as any other software used everyday, so with inputs (in this case they are servers so the input is the TCP/IP network) and vulnerabilities: stack and heap overflows, integer overflows, arbitrary commands execution, format strings, double and arbitrary memory frees, memory corruptions, directory traversals, design problems and various other bugs. Full-disclosure advisories and proof-of-concepts: Siemens Tecnomatix FactoryLink: http://aluigi.org/adv/factorylink_1-adv.txt http://aluigi.org/adv/factorylink_2-adv.txt http://aluigi.org/adv/factorylink_3-adv.txt http://aluigi.org/adv/factorylink_4-adv.txt http://aluigi.org/adv/factorylink_5-adv.txt http://aluigi.org/adv/factorylink_6-adv.txt (DoS only) Iconics GENESIS32 and GENESIS64: http://aluigi.org/adv/genesis_1-adv.txt http://aluigi.org/adv/genesis_2-adv.txt http://aluigi.org/adv/genesis_3-adv.txt http://aluigi.org/adv/genesis_4-adv.txt http://aluigi.org/adv/genesis_5-adv.txt http://aluigi.org/adv/genesis_6-adv.txt http://aluigi.org/adv/genesis_7-adv.txt http://aluigi.org/adv/genesis_8-adv.txt http://aluigi.org/adv/genesis_9-adv.txt http://aluigi.org/adv/genesis_10-adv.txt http://aluigi.org/adv/genesis_11-adv.txt http://aluigi.org/adv/genesis_12-adv.txt http://aluigi.org/adv/genesis_13-adv.txt 7-Technologies IGSS (Interactive Graphical SCADA System): http://aluigi.org/adv/igss_1-adv.txt http://aluigi.org/adv/igss_2-adv.txt http://aluigi.org/adv/igss_3-adv.txt http://aluigi.org/adv/igss_4-adv.txt http://aluigi.org/adv/igss_5-adv.txt http://aluigi.org/adv/igss_6-adv.txt http://aluigi.org/adv/igss_7-adv.txt http://aluigi.org/adv/igss_8-adv.txt DATAC RealWin: http://aluigi.org/adv/realwin_2-adv.txt http://aluigi.org/adv/realwin_3-adv.txt http://aluigi.org/adv/realwin_4-adv.txt http://aluigi.org/adv/realwin_5-adv.txt http://aluigi.org/adv/realwin_6-adv.txt http://aluigi.org/adv/realwin_7-adv.txt http://aluigi.org/adv/realwin_8-adv.txt --- Luigi Auriemma http://aluigi.org