CVE-2015-6477 in Control 2 SCADA
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA 16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/03/2026
The vulnerability identified as CVE-2015-6477 represents a critical security flaw within the Wind Farm Portal application component of Nordex Control 2 SCADA systems version 16 and earlier. This issue manifests as multiple cross-site scripting vulnerabilities that fundamentally compromise the security posture of industrial control systems used in wind energy infrastructure. The affected Wind Farm Portal application serves as a web-based interface for monitoring and controlling wind farm operations, making it a prime target for cyber adversaries seeking to exploit weaknesses in industrial automation and control systems.
The technical nature of this vulnerability stems from insufficient input validation and output encoding mechanisms within the Wind Farm Portal application. Attackers can leverage unspecified vectors to inject malicious web scripts or HTML code into the application's web interface, which then executes in the context of other users' browsers. This class of vulnerability directly maps to CWE-79 - Improper Neutralization of Input During Web Page Generation, which specifically addresses the failure to properly sanitize user inputs before incorporating them into web pages. The vulnerability exists because the application fails to adequately filter or escape user-supplied data that gets rendered in web responses, creating an environment where malicious payloads can be executed within the browser context of legitimate users.
The operational impact of CVE-2015-6477 extends beyond typical web application security concerns due to its presence in industrial control systems. Wind farm operations rely heavily on SCADA systems for real-time monitoring and control of critical infrastructure components including turbines, transformers, and grid connections. An attacker exploiting this vulnerability could potentially manipulate the web interface to display false operational data, disrupt control commands, or establish persistent access points within the industrial network. This represents a significant risk to operational technology environments where the integrity of monitoring and control interfaces directly affects physical system safety and operational continuity. The vulnerability could enable adversaries to perform reconnaissance activities, gather sensitive operational information, or even influence the actual physical operation of wind farm equipment through manipulation of the web-based control interface.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1566 - Phishing, as attackers could craft malicious web pages designed to exploit the XSS flaw and deliver payloads to unsuspecting operators. The vulnerability also supports lateral movement tactics through T1071.1003 - Application Layer Protocol: Dns, as attackers might use the compromised interface to redirect users to malicious domains. Organizations operating Nordex Control 2 SCADA systems should implement immediate mitigations including input validation controls, output encoding mechanisms, and regular security updates to address this vulnerability. The remediation approach should focus on implementing proper web application security controls such as content security policies, input sanitization, and regular security assessments of industrial control system web interfaces. Additionally, network segmentation and access controls should be strengthened to limit potential lateral movement if exploitation occurs, as this vulnerability specifically affects the web-based portal interface of critical industrial control systems.