Trihedral VTScada (formerly VTS) Remote DoS via WAP Interface (CVE‑2016‑4523)
What It Is
A medium‑severity vulnerability (CVE‑2016‑4523) exists in the Web Access Point (WAP) interface of Trihedral VTScada. An unauthenticated remote attacker can trigger conditions that exhaust system resources, leading to a denial‑of‑service (DoS) and loss of supervisory control.
Exploitability
The flaw is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No public proof‑of‑concept code has been released, and there are no confirmed active exploitation reports. The CVSS base score reflects a moderate likelihood of remote exploitation.
Affected Products
- Vendor: Trihedral
- Product: VTScada (formerly VTS) – all versions exposing the WAP interface.
Why It Matters for Compliance & Audit Readiness
Availability is a core control in frameworks such as NIST CSF, ISO 27001, and IEC 62443. An unmitigated DoS undermines continuous monitoring and can break the audit trail required for regulatory reporting (e.g., NERC CIP, GDPR‑related service‑availability clauses). Mapping this vulnerability to the Access Controls / Availability domain strengthens vendor‑management controls and provides defensible evidence that the organization has performed due‑diligence on third‑party OT software.
Recommended Actions
- Control Mapping: Document the VTScada WAP interface under the “Availability – Service Continuity” control in your risk register.
- Patch Management: Verify that the latest vendor‑issued patch or mitigation (e.g., disabling the WAP interface) is applied across all OT environments.
- Network Segmentation: Restrict WAP access to trusted management subnets and enforce strict firewall rules.
- Monitoring: Enable logging of WAP traffic and set alerts for abnormal request patterns that could indicate a DoS attempt.
- Incident Playbooks: Update OT incident‑response procedures to include DoS detection and rapid service restoration steps.
Source: CISA KEV – CVE‑2016‑4523