MatrikonOPC Improper Input Validation
Low RiskICS-CERT ICSA-14-010-01Oct 13, 2014
Summary
MatrikonOPC SCADA DNP3 OPC Server versions 1.2.2.0 and earlier contain improper input validation in how they process DNP3 protocol data. An attacker can send malformed input that is not properly validated before processing, potentially causing the server to crash or behave unexpectedly. The vendor has not planned to release a fix for this product.
What this means
What could happen
Improper input validation in MatrikonOPC SCADA DNP3 OPC Server could allow an attacker to send malformed data that crashes the server or causes unpredictable behavior, disrupting data flow between your SCADA system and connected devices.
Who's at risk
Energy sector operators using MatrikonOPC SCADA DNP3 OPC Server to bridge DNP3 field devices (RTUs, relays, meters) with SCADA systems. This includes electric utilities and water authorities that rely on OPC servers for real-time data collection from distributed devices.
How it could be exploited
An attacker with network access to the OPC server sends specially crafted input data (likely via DNP3 protocol traffic or OPC interface queries) that bypasses input validation checks. The server processes the malformed data without proper sanitization, leading to a crash or memory corruption.
Prerequisites
- Network access to the MatrikonOPC SCADA DNP3 OPC Server port (typically 502 for DNP3 or OPC ports)
- No authentication required based on typical OPC server configurations
remotely exploitableno authentication requiredno patch availableOPC server discontinuation
Exploitability
Low exploit probability (EPSS 0.5%)
Affected products (1)
ProductAffected VersionsFix Status
MatrikonOPC SCADA DNP3 OPC Server: <=1.2.2.0≤ 1.2.2.0No fix (EOL)
Remediation & Mitigation
0/4
Do now
0/3HARDENINGImplement network segmentation to restrict access to the OPC server from only authorized SCADA workstations and field devices; use firewall rules to block unexpected connections to the server port
HARDENINGMonitor network traffic to and from the OPC server for anomalous or malformed packets that could indicate exploitation attempts
WORKAROUNDDisable or restrict OPC network access if the server is only used locally; configure it to listen only on localhost or internal network interfaces
Mitigations - no patch available
0/1MatrikonOPC SCADA DNP3 OPC Server: <=1.2.2.0 has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGEvaluate migration to a maintained version or replacement OPC server product, as MatrikonOPC SCADA DNP3 OPC Server version 1.2.2.0 and earlier will not receive vendor patches
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/16167072-ff81-4ba2-a491-b10421e9bd48