## https://sploitus.com/exploit?id=8330C8D8-76F2-5681-B9DB-1FEE71931C2C
# SCADAPack Secure Lock fixture verifier
This repository is a deliberately bounded proof of concept for
**CVE-2026-81861**. It verifies that two controlled fixtures produced with the
vendor's shipped Windows DTM can be authenticated and decoded using common key
material.
It is not an operational exploit. It contains no network client, device target,
DNP3 transmitter, unlock operation, message-forging command, capture scanner,
or arbitrary-file decryptor. It cannot contact or change an RTU.
## Demonstrated result
The verifier accepts only these exact bundled files, pinned by SHA-256:
- `samples/vendor_generated/vendor_message_s1.bin`: complete message produced
by the vendor DTM's own message initializer.
- `samples/vendor_generated/harnessB_vendor_ciphertext_and_mac.bin`: ciphertext
and MAC produced by vendor cryptographic routines over researcher-assembled
product-format bytes.
Neither file came from a physical RTU. They demonstrate interoperability with
the shipped DTM implementation, not live-device acceptance or network
exploitability.
## Key handling
Production constants and keys are not included. A researcher who already has
authorized access to the affected software may supply a local JSON file:
```json
{
"hmac_sha256_key": "",
"aes128_kek": ""
}
```
Do not commit that file. Run the bounded verification with:
```bash
python3 securelock_poc.py verify-fixtures --key-file /path/to/local-keys.json
```
The command rejects any file not named in its fixture allowlist and checks the
SHA-256 digest before parsing. It never prints supplied keys.
## Tests
```bash
python3 tests/test_vectors.py
```
The default suite uses public AES/RFC 3394 test vectors and non-production test
keys. If `SECURELOCK_FIXTURE_KEY_FILE` names a valid local key file, it also
verifies both vendor-generated fixtures; otherwise those tests are skipped.
## Scope and limitations
- Confirmed here: digest-gated fixture parsing, AES decryption, RFC 3394 unwrap,
strict bounds, and optional recovery from two vendor-DTM fixtures.
- Not demonstrated: RTU traffic, live interoperability, device acceptance,
access to protected functionality, or any state change.
See Schneider Electric advisory `SEVD-2026-251-03` for affected products,
mitigations, and vendor guidance.