HMI & SCADA Software Lab
A calm-looking HMI can sit on the worst box on the network. In 12 rounds you read an HMI mimic and its exposure banner for real SCADA software — Siemens WinCC/SIMATIC, AVEVA/Wonderware InTouch, GE iFIX, Inductive Automation Ignition, Rockwell FactoryTalk, Schneider — and pick the primary risk and the fix. The risks are real CVE classes: default or hardcoded credentials (the WinCC password Stuxnet used, CVE-2010-2772), internet-facing HMIs per Shodan/CISA, unpatched RCE, and missing authentication for a critical function (CWE-306). Defender lens only — real products and documented classes, no exploit code, no payloads, no real credentials.
The real job. More noise, a tighter clock.
HMI 1 / 12
Siemens SIMATIC WinCC · WinCC / SQL backend
A WinCC SCADA server whose backend SQL database still carries the vendor-shipped account.
1 · Primary risk
2 · Right fix
Pick the primary risk and the right fix.
HMI triage
12 real SCADA/HMI products, each with an exposure banner to read — internet-facing, default creds, unpatched CVE, flat network. Pick the primary risk and the fix that matches it. A calm-looking mimic can hide the worst box on the network.
So far: 0 / 12 triaged.
Read the banner, then fix in order
Internet-facing → take it off the internet first — it shrinks the attacker set the fastest.
Default / hardcoded creds (WinCC CVE-2010-2772) → rotate + MFA. Known CVE → patch, or segment-and-monitor if no fix.
Critical function, no auth (CWE-306) → enforce authorization.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based triage lab for real SCADA/HMI software: read an HMI mimic plus an exposure banner, then pick the primary risk and the right fix.
- Covers the products you actually meet — Siemens WinCC/SIMATIC, AVEVA/Wonderware InTouch, GE iFIX, Inductive Automation Ignition, Rockwell FactoryTalk and Schneider — across 12 rounds.
- Risks are real CVE classes: default / hardcoded credentials (the WinCC password Stuxnet used, CVE-2010-2772), internet-facing HMIs per Shodan/CISA, unpatched RCE / auth bypass, and missing authentication for a critical function (CWE-306).
- Fixes map to the risk: rotate credentials and add MFA, take the HMI off the internet, apply the vendor patch (or segment-and-monitor when there is no patch), or enforce authorization — and when several apply at once, cut reachability first.
- Scored and graded S–D. Educational and defender-focused — real product names and documented CVE classes only. No exploit code, no payloads, no real device credentials.
Read the exposure, not the pretty screen
HMIs are where an operator sees the plant, which makes them a high-value, often weakly-defended target. The most famous case is Siemens WinCC: it shipped with a hardcoded SQL database password (CVE-2010-2772) that Stuxnet used to reach the WinCC database. That is the default/hardcoded-credential class, and it recurs across vendors — Rockwell FactoryTalk, Schneider and others appear in CISA ICS advisories for default or weak credentials and access-control gaps.
The other classes are just as real. Internet-facing HMIs are found constantly by Shodan and flagged by CISA; an HMI on a public IP is reachable by any attacker, so every other weakness becomes exploitable at once. Web-based SCADA platforms like Inductive Automation Ignition and nodes of AVEVA/Wonderware InTouch have published RCE and input-handling advisories — patchable where a fix exists. And missing authentication for a critical function(CWE-306) — a project download or config change that answers an unauthenticated caller — shows up even on fully-patched, credentialed systems.
The triage habit the lab builds is to read the exposure banner first and fix in order of leverage: when an HMI is internet-facing, default-credentialed and unpatched all at once, you cut reachability first (off the internet, behind a VPN, segmented), because that shrinks the attacker set from the whole internet to your own network faster and cheaper than any other control — then you rotate credentials, patch, and enforce authorization.
Frequently asked questions
What is the HMI & SCADA Software Lab?
A free, in-browser triage exercise. Each round shows an HMI mimic for a real SCADA/HMI product — Siemens WinCC/SIMATIC, AVEVA/Wonderware InTouch, GE iFIX, Inductive Automation Ignition, Rockwell FactoryTalk or Schneider — plus an exposure banner (internet-facing, default credentials, unpatched CVE, flat network). You read both and pick the primary risk and the fix that matches it. It is a defender-lens teaching simulation using real product names and documented CVE classes; there is no exploit code, no payloads and no real credentials.
What real vulnerabilities does it reference?
The one specific CVE it anchors on is Siemens WinCC’s hardcoded SQL database password, CVE-2010-2772, which Stuxnet used to reach the WinCC database — a well-documented hardcoded-credential case. Everything else is described as a CVE class rather than invented CVE numbers: default / hardcoded credentials, missing authentication for a critical function (CWE-306), and unpatched remote-code-execution or authentication-bypass issues — the categories these products repeatedly show in CISA ICS advisories. The internet-exposure scenarios reflect the broad, real finding that HMIs are regularly discoverable on the internet via Shodan and CISA reporting.
How should you prioritise when several problems are true at once?
Cut reachability first. If an HMI is internet-facing, taking it off the internet (behind a VPN and segmented into the OT zone) instantly shrinks the attacker set from the whole internet to your own network, which is faster and cheaper than rotating credentials or patching. After reachability, rotate default/hardcoded credentials and enforce MFA, apply the vendor patch for any known CVE (or segment-and-monitor when no patch exists), and enforce authorization on any critical function that lacks it. The lab’s worst-case round drills exactly this ordering.
Why do internet-exposed HMIs keep happening?
Usually convenience: an operator or integrator wants remote visibility and assigns a public IP or forwards a port, often to a packaged HMI with a built-in web server. The device then sits on the internet with whatever default credentials and unpatched software it shipped with. Shodan scans and CISA advisories repeatedly surface these. The fix is a policy one as much as technical: no HMI or SCADA gateway should be directly internet-facing — remote access belongs behind a VPN or jump host, with the device segmented inside the OT network.