CVE-2011-1566: IGSS dc.exe directory traversal allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution in an industrial control system with public exploit code and very high EPSS probability.

What it is

The dc.exe component of 7-Technologies IGSS (version 9.00.00.11059 and earlier) is vulnerable to directory traversal via ..\ sequences embedded in opcodes 0xa and 0x17 sent to TCP port 12397. A remote attacker can use the traversal to place and execute arbitrary programs, giving full control of the SCADA host. The flaw is remotely reachable without authentication and carries a CVSS v2 score of 10.

Impact

An attacker gains arbitrary code execution on the IGSS server, which typically runs with high privileges in an industrial control environment, enabling full compromise of the host and potential disruption of connected control processes.

Attack surface

Reachable over the network by sending crafted opcodes to TCP port 12397; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Public exploit code exists (Exploit-DB 17024 and SecurityFocus BID 46936) and EPSS is 0.66982 (99.26th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the vendor fix for IGSS dc.exe; if no patch is available for the deployed version, upgrade to a supported release.
• Block or restrict TCP port 12397 at network boundaries and segment IGSS hosts from untrusted networks.
• Place IGSS systems behind a firewall with strict allowlists for control-system traffic only.
• Monitor and restrict outbound traffic from IGSS hosts to limit post-exploitation movement.
• Review US-CERT ICS-ALERT-11-080-03 and vendor advisories for additional compensating controls.

Detection

• Monitor network traffic to TCP port 12397 for opcodes 0xa and 0x17 containing ..\ sequences.
• Alert on unexpected process creation or file writes by dc.exe on IGSS hosts.
• Baseline and audit files written to IGSS installation directories for anomalous executables.
• Use IDS/IPS signatures for known IGSS dc.exe exploit traffic and review logs for repeated connection attempts to port 12397.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.