The most common application security weakness is the failure to properly validate input coming from a user or the environment the application runs in before using it. By not scrutinizing the input in your application, unexpected behavior of the application can be triggered by forcing the application to run snippets of a scripting language or forward sensitive system commands.
ICS applications can suffers from these kinds of vulnerabilities as much as any other software. Custom HMI programs, controller logic, and home grown utilities often neglect input validation and are prime candidates for attack. Furthermore, ICS devices often come with built-in web pages for diagnostic purposes running on poorly implemented ...
