CVE-2011-1565: IGSS SCADA Data Server Directory Traversal via TCP Port 12401

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote file read/write against a SCADA server with public exploits and very high EPSS probability makes this a critical exposure for any reachable IGSS deployment.

What it is

IGSSdataServer.exe in 7-Technologies IGSS 9.00.00.11063 and earlier contains a directory traversal flaw (CWE-22) that lets remote attackers read, create, or write arbitrary files using ..\ sequences sent to TCP port 12401. Because the affected component is a SCADA data server, successful exploitation can compromise both data confidentiality and integrity on industrial control system hosts.

Impact

An unauthenticated attacker can read arbitrary files from the host and create or overwrite arbitrary files, which can expose sensitive configuration or data and potentially enable further compromise through file writes. The CVSS 2.0 vector rates confidentiality, integrity, and availability impact as complete.

Attack surface

The flaw is reachable over the network via TCP port 12401 using crafted opcodes (0x3 for read, 0x2 for create/write) containing ..\ traversal sequences. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/Au:N).

Exploitation

Public exploit references are present (Exploit-DB, SecurityFocus, aluigi.org advisory), and EPSS indicates a high 30-day exploitation probability (0.64063, 99.187th percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the vendor patch or upgrade IGSS to a version later than 9.00.00.11063 as directed by 7-Technologies/Schneider Electric advisories.
• Restrict network access to TCP port 12401 to trusted engineering and control hosts using firewall or ACL rules.
• Segment the IGSS data server from general IT and untrusted networks to limit reachable attack paths.
• Monitor and validate file integrity on IGSS hosts to detect unauthorized file creation or modification.
• If patching is not immediately possible, consider compensating controls such as application allowlisting and strict egress/ingress filtering.

Detection

• Inspect network traffic to TCP port 12401 for opcodes 0x2 or 0x3 containing ..\ or ..%5c traversal sequences.
• Monitor file system changes on IGSS hosts for unexpected file creation or modification in application and system directories.
• Review IDS/IPS signatures and logs for known IGSS traversal exploit patterns and alerts tied to port 12401.
• Correlate unusual outbound or lateral connections from IGSS hosts with file access anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.