Privileged File System Vulnerability Present in a SCADA System
Summary: Unit 42 found CVE-2025-0921, a privileged file system operations vulnerability with a Medium CVSS score of 6.5, in the Iconics Suite SCADA system for Microsoft Windows versions 10.97.2 and earlier, identified during an early 2024 assessment that surfaced five vulnerabilities. A non-administrative attacker can chain it with CVE-2024-7587, which gives every local user read and write access to C:\ProgramData\ICONICS, to point the Pager Agent's SMSLogFile path at a symbolic link targeting C:\Windows\System32\cng.sys, so that PagerCfg.exe overwrites the driver with log data and the operating system fails to boot.
Why it matters: The exploit needs no administrator rights and no zero-day: it waits on a routine action, an administrator sending a test SMS or AlarmWorX MMX firing an automatic alert, and leaves the SCADA host stuck in failed repair mode. Iconics Suite runs industrial processes in automotive, energy and manufacturing, so a corrupted boot on one of those hosts is an availability incident, not an IT ticket.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-7587CVE-2025-0921
- Related
- ⚡ Weekly Recap: Proxy Botnet, Office Zero-Day, MongoDB Ransoms, AI Hijacks & New Threats Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026