What’s Vulnerable › Vulnerabilities

CVE-2022-25359

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 37.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-26 · updated 2026-06-17
• Weakness: CWE-306

Description

On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files.

Affected products

• Iclinks Scadaflex Ii Firmware: 1.01.01, 1.01.14, 1.02.01, 1.02.15, 1.02.20, 1.03.07
• Iclinks Weblib: 1.13, 1.14, 1.16, 1.22, 1.24

References

• http://files.iclinks.com/datasheets/Scadaflex%20II/Scadaflex%20SC-1%20&%20SC-2_A1_compressed.pdf
• https://packetstormsecurity.com/files/166103/ICL-ScadaFlex-II-SCADA-Controllers-SC-1-SC-2-1.03.07-Remote-File-Modification.html
• http://files.iclinks.com/datasheets/Scadaflex%20II/Scadaflex%20SC-1%20&%20SC-2_A1_compressed.pdf
• https://packetstormsecurity.com/files/166103/ICL-ScadaFlex-II-SCADA-Controllers-SC-1-SC-2-1.03.07-Remote-File-Modification.html

Get alerted when CVE-2022-25359 or the next vulnerability affects your stack