DuraComm DP-10iN-100-MU

An attacker with engineering credentials could view sensitive configuration or operational data from the device, or disrupt its normal operation by triggering a denial-of-service condition. If this device manages critical process control or monitoring, such disruption could affect plant operations or data integrity.

Water utilities and municipal electric facilities using DuraComm SPM-500 DP-10iN-100-MU equipment for monitoring, control, or data acquisition should evaluate their exposure. This device is typically used for remote site communication, telemetry, or RTU (Remote Terminal Unit) functionality. Any facility relying on this equipment for process visibility or control should assess the impact of a potential denial-of-service or data disclosure event.

An attacker with valid engineering workstation credentials could authenticate to the device's web interface over the network. Once authenticated, the attacker could exploit missing input validation (CWE-79) to inject commands, abuse missing authentication checks on specific functions (CWE-306), or intercept unencrypted data (CWE-319) to extract process or configuration information, or craft requests to trigger resource exhaustion and stop the device's normal function.