ICS-CERT has issued an alert about the existence and general availability of the proof-of-concept exploit code for a tool that can brute force passwords and thus gain access and control of programmable logic controllers (PLCs).

The authors of the Python code in question are Alexander Timorin and Dmitry Sklyarov of SCADA Strange Love research group, and have unfortunately made the code available before the Siemens had the opportunity patch the flaw or offer mitigations.

In order to be able to use the tool, an attacker must first capture TCP/IP traffic containing the authentication data in the challenge-response form, and then by using the script, tries out different passwords until it finds a match.

Until Siemens comes out with mitigation, users of the affected controllers should minimize the risk to their systems by unplugging control system devices from the Internet, put them behind firewalls and isolate them from the business network, and employ secure methods for remote access.

In the meantime, the script seems to have been incorporated in the popular John the Ripper password cracking tool.

ICS-CERT expressed its fear that the script can be adapted to be used against other vendor products.