Exploit for InduGuard_vul_poc CVE-2010-2772 CVE-2014-0751 CVE-2015-5374 CVE-2019-6503 CVE-2019-6829 CVE-2019-6833 CVE-2020-12038 CVE-2020-5595 CVE-2020-8476 CVE-2021-22277 CVE-2021-22681 CVE-2021-27478 CVE-2021-38397 CVE-2023-2573 CVE-2023-27396

## https://sploitus.com/exploit?id=E210A992-6AFE-56B2-91A8-CA375A8B7142
# ICS Vulnerability PoC Library — SCAA Benchmark Support

Proof-of-concept vulnerability samples for the 15 high-impact CVEs evaluated in  
**RQ6 (Industrial Practicability and Real-World Efficacy)** of:

> *"SCAA: Semantic-Contextual Attributed Graphs for Industrial Binary Vulnerability Detection"*

---

## Purpose

This library provides **detection-oriented PoC samples** for the SCAA static analysis benchmark.  
Each PoC is a compilable C source file that faithfully reproduces the **vulnerability pattern**  
(CWE category, trigger path, and code structure) of the target CVE.

> **Scope**: These samples are designed for static binary analysis and vulnerability detection  
> research. They are **not** network-weaponised exploits and do not target live ICS systems.  
> All APT-category samples reproduce the documented CWE pattern only — no destructive payload.

---

## CVE Coverage (RQ6 Table, Manuscript §5.6)

| # | CVE | Target | Category | CWE | Detection |
|---|-----|--------|----------|-----|-----------|
| 1 | CVE-2021-27478 | Rockwell EtherNet/IP | PF | CWE-121 | ✓ |
| 2 | CVE-2019-6833 | Schneider Modicon (VxWorks) | PF | CWE-787 | ✓ |
| 3 | CVE-2020-5595 | Mitsubishi MELSEC-Q | PF | CWE-20 | ✓ |
| 4 | CVE-2021-22277 | ABB AC800M (MMS) | PF | CWE-400 | ✓ |
| 5 | CVE-2021-22681 | Siemens S7-1200 | AE | CWE-321 | ✓ |
| 6 | CVE-2020-12038 | Rockwell Studio 5000 | AE | CWE-287 | ✓ |
| 7 | CVE-2020-8476 | ABB AC500 PLC | AE | CWE-798 | ✓ |
| 8 | CVE-2023-27396 | Omron CJ2M (FINS) | AE | CWE-306 | ✓ |
| 9 | CVE-2015-5374 | Siemens WinCC | SA | CWE-119 | ✓ |
| 10 | CVE-2023-2573 | AVEVA InTouch HMI | SA | CWE-287 | ✓ |
| 11 | CVE-2019-6503 | GE CIMPLICITY HMI | SA | CWE-22 | ✓ |
| 12 | CVE-2021-38397 | Honeywell Experion PKS | SA | CWE-78 | ✓ |
| 13 | CVE-2010-2772 | Siemens Step7 (Stuxnet) | APT | CWE-798 | ✓ |
| 14 | CVE-2019-6829 | Schneider Triconex (Triton) | APT | CWE-345 | ~ |
| 15 | CVE-2014-0751 | GE CIMPLICITY (BlackEnergy) | APT | CWE-22 | ✓ |

**Categories**: PF = Protocol Fuzzing · AE = Authentication/Encryption · SA = SCADA/HMI Application · APT = Advanced Persistent Threat  
**Detection**: ✓ = Full detection · ~ = Partial detection (similarity score below threshold)

---

## Repository Structure

```
software_vul_poc/
├── README.md
├── .gitignore
├── category_PF/          Protocol-level parsing vulnerabilities
│   ├── CVE-2021-27478/   CIP integer sign confusion → stack overflow
│   ├── CVE-2019-6833/    URGENT/11 TCP/IP heap overflow (VxWorks)
│   ├── CVE-2020-5595/    MELSEC-Q improper input validation
│   └── CVE-2021-22277/   MMS malformed packet → resource exhaustion
├── category_AE/          Authentication & encryption weaknesses
│   ├── CVE-2021-22681/   S7 hardcoded cryptographic key
│   ├── CVE-2020-12038/   Studio 5000 authentication bypass
│   ├── CVE-2020-8476/    AC500 hardcoded credentials
│   └── CVE-2023-27396/   FINS missing authentication
├── category_SA/          SCADA/HMI software vulnerabilities
│   ├── CVE-2015-5374/    WinCC memory corruption (CIP EN100)
│   ├── CVE-2023-2573/    InTouch HMI web auth bypass
│   ├── CVE-2019-6503/    CIMPLICITY path traversal
│   └── CVE-2021-38397/   Experion PKS command injection
├── category_APT/         APT-level ICS malware patterns
│   ├── CVE-2010-2772/    Stuxnet Step7 hardcoded DB password
│   ├── CVE-2019-6829/    Triton/TRITON TriStation safety bypass
│   └── CVE-2014-0751/    BlackEnergy CIMPLICITY directory traversal
└── harness/
    ├── build_all.sh       Compile all C samples
    ├── run_scaa.py        Feed binaries to SCAA detection pipeline
    └── expected_results.json
```

---

## Build & Test

```bash
# Compile all PoC samples (requires gcc or arm-linux-gnueabi-gcc)
bash harness/build_all.sh

# Run SCAA detection on all compiled binaries
python harness/run_scaa.py --model-path /path/to/trained/model

# Expected: 14/15 detections (CVE-2019-6829 partial, score 0.74 < τ=0.78)
```

---

## Advisory References

Each CVE directory contains a `README.md` with:
- NVD detail page link
- ICS-CERT / CISA advisory link  
- Vendor security bulletin
- Public research/analysis references

---

## Ethical Use Statement

These samples are released under **CC BY-NC 4.0** for academic and defensive security  
research only. They reproduce documented vulnerability patterns for detection system  
evaluation and are not intended for offensive use against production systems.

All APT-category files reproduce only the CWE-level code pattern described in  
public post-mortem analyses. No functional destructive payload is included.