Vulnerability record · CVE-2013-2827 · published 15 January 2014
CVE-2013-2827: WellinTech KingSCADA ActiveX control remote DLL code execution
Wellintech · Kingalarm\&Event
An unspecified ActiveX control in WellinTech KingSCADA, KingAlarm&Event and KingGraphic accepts a ProjectURL property value that causes the client to download and execute an arbitrary DLL. Because the flaw is reachable over the network without authentication, it exposes HMI/SCADA operator workstations to remote code execution.
Description
An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 allows remote attackers to download arbitrary DLL code onto a client machine and execute this code via the ProjectURL property value.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated network-reachable remote code execution in SCADA client software with a high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.
What it is
An unspecified ActiveX control in WellinTech KingSCADA, KingAlarm&Event and KingGraphic accepts a ProjectURL property value that causes the client to download and execute an arbitrary DLL. Because the flaw is reachable over the network without authentication, it exposes HMI/SCADA operator workstations to remote code execution.
Impact
An attacker can place and run arbitrary code on a client machine in the operator's context, giving full control of that workstation and a foothold inside the control network.
Attack surface
Reached over the network via the ActiveX control's ProjectURL property; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no special conditions, and the description does not require user interaction beyond loading the affected control.
Exploitation
Not listed in CISA KEV and no public exploit reference is tagged, but EPSS is high at roughly 0.48 (98.8th percentile), indicating elevated likelihood of attempted exploitation.
What to do
- Apply the vendor patches referenced in ICS-CERT advisory ICSA-13-344-01 to move KingSCADA to 3.1.2 or later, KingAlarm&Event and KingGraphic to 3.1 or later.
- Restrict network access to SCADA clients and servers so only trusted hosts can reach the ActiveX control.
- Disable or block the affected ActiveX control in the browser/OS and enforce allowlisting of signed controls.
- Harden clients against DLL loading from untrusted paths and monitor for unexpected DLL writes or loads.
- Segment HMI/operator workstations from general IT and internet access.
Detection
- Monitor for unexpected DLL files written to client directories or temp paths associated with KingSCADA, KingAlarm&Event or KingGraphic.
- Alert on process creation where SCADA client processes load DLLs from non-standard or user-writable locations.
- Watch network traffic from SCADA clients to unfamiliar hosts consistent with ProjectURL-driven downloads.
- Review ICS-CERT advisory guidance and vendor logs for ActiveX control instantiation anomalies on operator workstations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://ics-cert.us-cert.gov/advisories/ICSA-13-344-01 | PatchUS Government Resource |
| http://ics-cert.us-cert.gov/advisories/ICSA-13-344-01 | PatchUS Government Resource |
Track CVE-2013-2827 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-2827), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
