SECURE_NODE // ATHENS_GR
← BACK TO RESEARCH Vulnerability · OT / SCADA · Industrial

Unauthenticated SQLi in a SCADA Control Server

10 JUN 2026| ≈ 3 MIN READ| SCADAOTSQLi
SANITIZED ▸ Methodology only. All hostnames, IP addresses, and organizational details are lab placeholders. No client name, real IP, real OT device identifier, or production system detail appears here. Assessment was authorized and scoped in writing.

An OT/SCADA telecontrol server, reachable on the corporate flat LAN with no network segmentation between the office domain and the operational technology network, was running a version with a known unauthenticated SQL injection vulnerability. Any domain-joined workstation had direct TCP access to the server's management interface.

OT SERVER SEVERITY
Critical
unauthenticated SQLi, OT impact
NETWORK POSITION
Flat LAN
no OT / IT segmentation
SCOPE
Internal
black-box, on-site

The detection

A vulnerability scan of the full internal range returned the advisory match immediately. Manual verification confirmed the version string from a direct TCP connection:

# vulnerability scanner output — lab (sanitized)
Plugin: OT/SCADA Control Server — Unauthenticated SQLi
CVSS v3: 9.8 (Critical)

Host: 10.10.10.50
Port: [management-port]/tcp

# manual version verification
nc -nv 10.10.10.50 [management-port]
OT Telecontrol Server [vulnerable-version]

# version confirmed — below patched threshold
# unauthenticated SQL injection in the management interface
# no authentication required to reach the vulnerable endpoint

The SQL injection is unauthenticated. The server's management interface processes protocol frames, and the vulnerable version does not sanitise string inputs before constructing SQL queries against the internal database. Exploitation via SQLi can expose the control server's database — historical telemetry, device configurations, user credentials, and communication endpoints for connected RTUs and PLCs. Depending on what is stored and how the OT network is structured downstream, the path from SQLi to operational impact is short.

The surrounding findings

The OT server finding does not exist in isolation. Three companion findings from the same engagement: LLMNR/mDNS poisoning enabling NTLM hash relay from any domain host on the flat LAN, cleartext SMB credentials captured in transit from a legacy service, and a successful password spray using the captured credentials against domain accounts. The combination of an unsegmented OT server, NTLM relay capability, and credential access creates a multi-path route to the operational control plane.

The test timeline

DAY 1 — SCAN

Vulnerability scan across internal range. OT telecontrol server identified on the internal range. CVE match returned from version fingerprint.

DAY 1 — VERSION CONFIRMED

Direct TCP connection confirms vulnerable version. Below patched threshold. Unauthenticated SQLi applicable. No network segmentation between office LAN and OT server confirmed.

DAY 1 — LLMNR RELAY

LLMNR poisoning active on the flat LAN. An LLMNR poisoning tool capturing NTLM challenge-response within minutes of starting. Cleartext SMB credentials captured from legacy service also on the flat network.

DAY 2 — PASSWORD SPRAY

Captured credentials sprayed against domain. Successful authentication to domain accounts with credentials from the cleartext capture. Scope of NTLM relay and DA path documented.

DAY 2 — REPORT

All findings documented. OT exposure flagged as immediate priority. Network segmentation identified as the most impactful single remediation step.

Securing the OT environment

  • Segment the OT network immediately. The telecontrol server and all connected RTU/PLC endpoints must be placed in a dedicated OT VLAN with firewall rules restricting access to only the operator workstations that legitimately require connectivity. No general corporate domain workstation should be able to reach the OT management interface.
  • Apply the vendor-supplied patch to bring the telecontrol server to a supported, patched version. Confirm the version string post-upgrade via the management interface.
  • Disable LLMNR and NBT-NS; enforce LDAP signing and channel binding. On all domain controllers and workstations, disable LLMNR via Group Policy. Disable NBT-NS on all adapters. Enable LDAP server signing requirements. These three changes remove the relay chain from domain-joined hosts to the OT server and to domain controllers simultaneously.
  • Remove hardcoded credentials from SMB shares. Any script, configuration file, or batch job storing cleartext credentials on a shared network path must be migrated to a secrets management solution. Rotate all credentials that appear in captured traffic or accessible shares.

The takeaway

An unauthenticated SQL injection on an operational control server, directly reachable from every workstation on the corporate domain — the segmentation fix is not a security enhancement. It is the minimum baseline for any network that includes OT equipment.