Researchers: SCADA Mobile Apps Continue to Have ‘Shocking’ Number of Vulnerabilities

Researchers from IOActive and Embedi analyzed 34 mobile SCADA applications and discovered 147 vulnerabilities that expose industrial control systems to attack. The flaws include insecure local storage and improper encryption, and enable three main attack vectors—physical access to devices, manipulation of unprotected communications (GSM/Wi‑Fi), and malicious apps on the same device—to allow data extraction, falsification, or direct influence of industrial processes; more than 20% of findings could directly misinform operators or affect process control. The report urges SCADA app developers and ICS operators to adopt secure coding practices and architecture changes to mitigate these risks.