PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-10313 iniNet Solutions CVE debrief

CVE-2024-10313 is a path traversal vulnerability in iniNet Solutions SpiderControl SCADA PC HMI Editor version 8.10.00.00, published by CISA on October 24, 2024. The vulnerability allows an attacker to craft a malicious `.ems` project template file that, when loaded by the software, can write files to arbitrary directories on the host system. This capability enables overwriting critical system files to cause system paralysis or writing to startup locations to achieve persistent remote control. The vulnerability is rated CVSS 3.1 8.0 (High) with attack vector Network, low attack complexity, low privileges required, and user interaction required. CISA has assigned advisory ICSA-24-298-02 to track this issue. iniNet Solutions has released version 8.24.00.00 to remediate this vulnerability.

Vendor
iniNet Solutions
Product
SpiderControl SCADA PC HMI Editor
CVSS
HIGH 8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-10-24
Original CVE updated
2024-10-24
Advisory published
2024-10-24
Advisory updated
2024-10-24

Who should care

Organizations operating industrial control systems and SCADA environments using iniNet Solutions SpiderControl PC HMI Editor, particularly in critical infrastructure sectors. Asset owners, OT security engineers, and HMI operators responsible for maintaining safe and reliable human-machine interface deployments should prioritize patching. Security teams monitoring for file integrity anomalies in SCADA workstations and investigating potential supply chain compromises of project template files should also address this vulnerability.

Technical summary

The SpiderControl SCADA PC HMI Editor fails to properly sanitize file paths when processing .ems project template files. An attacker can embed directory traversal sequences (e.g., ../) within a crafted project file to escape intended directories and write files to arbitrary locations on the underlying operating system. This primitive enables multiple attack chains: overwriting system binaries or configuration files to cause denial of service, or writing executables to user or system startup folders to establish persistence and achieve remote code execution. The vulnerability requires user interaction to load the malicious project file and low privileges to execute, but the network attack vector indicates potential for social engineering or supply chain delivery mechanisms.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade iniNet Solutions SpiderControl SCADA PC HMI Editor to version 8.24.00.00 or later to remediate this path traversal vulnerability.
  • Restrict loading of untrusted .ems project template files and implement file integrity verification before opening project files in the HMI Editor.
  • Apply principle of least privilege to HMI Editor processes and restrict write permissions to critical system directories and startup locations.
  • Segment SCADA/HMI systems from untrusted networks and implement application allowlisting to prevent unauthorized executable deployment via startup folders.
  • Monitor for anomalous file system writes to sensitive locations such as Windows Startup folders, system directories, and service registry keys.

Evidence notes

Vulnerability description and remediation guidance sourced from CISA CSAF advisory ICSA-24-298-02. Affected product version 8.10.00.00 and fixed version 8.24.00.00 confirmed through CSAF product tree and remediation sections. CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H provided in source advisory.

Official resources

2024-10-24