SCADA Version & Firmware Triage
A mixed fleet of controllers and SCADA software lands on your desk — a Siemens S7-300 and a hardened S7-1500, Schneider Modicon M340 and M580, an Allen-Bradley ControlLogix comms module, a CODESYS OEM PLC, OPC UA servers, VxWorks and Treck devices, and old WinCC / STEP 7. For each, decide the known vulnerability class, how exposed it is, and the remediation that actually fits — because insecure-by-design has no patch, a comms-module bug does, and a hardened asset should be left alone. Real classes, real advisory sources, no invented CVEs.
The real job. More noise, a tighter clock.
Asset inventory
1 / 9 triaged
firmware V3.x (S7comm) · S7comm
Line-control PLC on the process LAN, programmed over S7comm.
1 · Known vulnerability class
2 · Exposure
3 · Remediation / compensating control
Pick a class, the exposure, and a remediation to continue.
Risk map
This asset: decide its class and where it lands on exposure.
Triage
A fleet of specific controllers and SCADA software. For each of 9 assets, decide the known vulnerability class (or none), the exposure, and the remediation that actually fits the class.
So far: 0 / 9 assets triaged.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based triage lab: work a fleet of specific OT assets — Siemens S7-300/1500, Schneider Modicon M340/M580, Allen-Bradley ControlLogix, a CODESYS controller, OPC UA servers, VxWorks and Treck devices, WinCC and STEP 7 — and decide the risk on each.
- For every asset you pick the known vulnerability CLASS (or "none — current & hardened"), the exposure, and the remediation or compensating control that actually fits.
- Vulnerabilities are described by documented class and source — Forescout OT:ICEFALL, Armis URGENT/11, JSOF Ripple20, CERT@VDE for CODESYS, Claroty/Pwn2Own for OPC UA, CISA/Rockwell for the ControlLogix comms module — with no invented CVE numbers.
- The core skill it drills: insecure-by-design protocols have no patch (isolate and migrate), patchable bugs get updated per advisory, stack flaws track the stack across brands, and hardened assets must not be over-flagged.
- An asset inventory plus a live exposure/severity risk map, difficulty tiers, a speed bonus and an S–D grade.
The remediation follows the class
Most OT vulnerability-management mistakes come from treating every finding the same way. The fleet in this lab is built to force the distinctions that matter. Insecure-by-design protocols — classic S7comm, Schneider UMAS, EtherNet/IP CIP — were never built to authenticate, so there is no patch; the answer is segmentation, access restriction, any platform password on offer, and a migration plan. A communication-module flaw or a CODESYS runtime or OPC UA stack bug is a specific, fixed-in-firmware defect — you update it per the vendor or CERT advisory. And an embedded TCP/IP stack class like URGENT/11 or Ripple20 rides in a component reused across many brands, so you track it by the stack, not the nameplate.
Just as important: do not over-flag. A current S7-1500 with access protection enabled, or an OPC UA server on a strong security policy with certificate authentication, is the hardened case — the right call is to keep it patched and monitored, not to rip it out. The whole skill of triage is telling the exposed, unauthenticated, exploitable asset apart from the one that is already doing the right things, and spending your limited remediation effort where it moves risk the most.
Frequently asked questions
What does SCADA Version & Firmware Triage teach?
It teaches how to triage a real OT asset inventory by version and firmware. Given specific controller families and SCADA software, you decide which known vulnerability class each falls into, how exposed it is, and the correct remediation. The lab makes the key distinction explicit: some conditions are insecure-by-design in the protocol and have no patch, some are specific bugs with a fixed firmware, and some ride in a shared network stack across many brands — and each calls for a different response.
Does it use real CVEs?
It describes vulnerabilities by well-documented CLASS and names the public program or advisory behind each — Forescout OT:ICEFALL and Project Basecamp for insecure-by-design native protocols, Armis URGENT/11 (VxWorks IPnet) and JSOF Ripple20 (Treck) for embedded TCP/IP stacks, CERT@VDE for the CODESYS runtime, Claroty / Pwn2Own ICS for OPC UA stacks, and the CISA/Rockwell 2023 advisories for ControlLogix communication modules. It deliberately does not quote specific CVE numbers or invent any, because the goal is to recognise the class and choose the right remediation.
Why is "insecure by design" treated differently from a normal bug?
Because there is nothing to patch. Native OT protocols like classic S7comm, Schneider UMAS and EtherNet/IP CIP were built without authentication, so no firmware update makes them demand credentials — the OT:ICEFALL research catalogued dozens of such conditions across major vendors. The remediation is architectural: segment and monitor the device, restrict who can reach the protocol, enable any application-layer password the platform does offer, and plan migration to a platform with authenticated communications. Treating it like a patchable bug leaves the exposure wide open.
Is this a real scanner or does it touch my devices?
No. It is an educational, offline triage exercise with a synthetic inventory. It does not connect to, scan, or touch any device, and it contains no exploit detail — only the defender decision of class, exposure and remediation. It is meant to build the judgement a vulnerability-management or OT-asset owner uses when a fleet of mixed-vintage controllers lands on their desk.