There are a variety of reasons why polling SCADA outstations may not provide adequate or timely information.  To address this, DNP3 supports unsolicited response where the outstations initiate a response without a poll request when a threshold is exceeded or an event is triggered.  The host has a DNP3 server that currently is configured to support unsolicited response.

DNP3 Application Layer function code 1 (Read) allows object values to be read across the network.  Binary input settings are typically mapped to relays or other sensors which are either on or off. 

The ability to read binary inputs may help an attacker profile a system.

The DNP3 protocol is a multi-layer protocol that begins with a link layer connection.  The DNP3 link layer address is required to establish a link layer connection.  The DNP3 link layer address for the host was easily guessed, and a valid DNP3 link layer connection was established. 

If a link layer connection is successful, additional Read/Write operations to compromise the integrity process control data may be possible.

The remote host is running a Siemens Telegyr ICCP Gateway. ICCP servers are commonly used in electric transmission and generation systems. Production EMS systems should be scanned carefully because they have been known to have vulnerabilities in proprietary applications and protocols.

The remote host is running the Telvent OASyS Application. Telvent OASyS is a SCADA system widely used to control pipelines. It may also be found in electric, water, and other SCADA systems.

The remote host contains Siemens S7-SCL (Structured Control Language) Development Tools. Siemens S7-SCL is a programming language based on PASCAL used for programming controllers on DCS/SCADA networks. S7-SCL is consistent with the ST (Structured Text) language define in DIN EN/IEC 61131-3 and is used to quickly automate tasks.

The remote host is running the Siemens PDM (Proces Device Manager) Application. Siemens SIMATIC PDM is used to manage multiple field devices from different vendors. It is common in plant/manufacturing systems and other SCADA systems.

National Instruments Lookout is an web-based human machine interface (HMI) and supervisory control and data acquisition (SCADA) software system for managing manufacturing and process control applications.

The remote host is running a Matrikon OPC Server for SCADA ControlLogix, which enables OPC access to ControlLogix PLCs. OPC servers are commonly used in SCADA and DCS systems to exchange data between different vendor systems and disparate applications.

The remote host is running Matrikon's OPC Explorer tool. This is a free tool that identifies and tests OPC servers and is useful for troubleshooting. Matrikon is one of the leading distributors of OPC-based applications.

The host contains additional OPC/DCOM applications and there may be trust relationships to exploit against OPC servers.

The remote host is running a Matrikon OPC Server for Modbus devices and used to access data from PLCs, RTUs, and IEDs. OPC servers are commonly used in SCADA and DCS systems to exchange data between different vendor systems and disparate applications.

The remote host is running an Areva/Alstom EMS (Energy Management) Server. Areva/Alstom EMS servers are commonly used in electric transmission and generation systems.

Production EMS systems should be scanned carefully because they have been known to have vulnerabilities in proprietary applications and protocols.

ID	Name	Severity
23810	DNP3 Outstation Unsolicited Messaging Support	medium
23809	DNP3 Binary Inputs Access Remote Information Disclosure	medium
23808	DNP3 Link Layer Brute Force Addressing Disclosure	medium
23807	Siemens-Telegyr ICCP Gateway Detection	info
23806	Telvent OASyS System Detection	info
23805	Siemens S7-SCL Development Tools Detection	info
23804	Siemens SIMATIC PDM Detection	info
23803	National Instruments Lookout Detection	info
23802	Matrikon OPC Server for ControlLogix Detection	info
23801	Matrikon OPC Explorer Detection	info
23800	Matrikon OPC Server for Modbus Detection	info
23799	Areva/Alstom Energy Management System Detection	info

Detections

Analytics

SCADA Family for Nessus

medium

medium

medium

info

info

info

info

info

info

info

info

info