CVE-2022-3181 is an improper input validation flaw (CWE-20) in Trihedral VTScada, SCADA/HMI software marketed specifically for water and wastewater utilities: a remote, unauthenticated attacker can send a specifically malformed HTTP request to crash the VTScada server on version 12.0.38 or earlier, and NVD rates the resulting denial-of-service impact 7.5 (high) on CVSS v3.1.
Vulnerability summary
7.5
High
0.8%
EPSS score (FIRST)
No
CISA KEV catalog
2022-11-02
Published
Vulnerability ID: CVE-2022-3181 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Trihedral VTScada SCADA/HMI software | cpe:2.3:a:trihedral:vtscada:*:*:*:*:*:*:*:* | VTScada 12.0.38 and prior; both LAN-only and internet-facing installations are affected, per CISA ICSA-22-300-04 |
What does this mean for affected devices?
CVE-2022-3181 (CWE-20, improper input validation) affects Trihedral VTScada, a SCADA/HMI platform Trihedral markets directly at water and wastewater utilities, publishing dedicated case studies of VTScada deployments at water and wastewater facilities worldwide (Trihedral — Water / Wastewater SCADA Software Case Studies and Stories).
NVD's description states: "An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affected VTScada to crash. Both local area network (LAN)-only and internet facing systems are affected" (NVD).
NVD records a Primary CVSS v3.1 score of 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-reachable, low attack complexity, no privileges or user interaction required, and an availability-only impact consistent with a crash/denial-of-service rather than data theft or tampering; the CISA ICS-CERT enrichment source recorded the identical score and vector as a Secondary rating (NVD).
The flaw is also tracked in CISA's ICS advisory ICSA-22-300-04, which NVD lists as a Patch / Third Party Advisory / US Government Resource reference for this CVE (CISA ICSA-22-300-04).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0080 (57.0th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Operators running VTScada 12.0.38 or earlier — whether on an isolated control-system LAN or an internet-facing historian/telemetry server — should update to a fixed VTScada release per CISA's advisory and restrict network exposure of the VTScada web interface in the meantime.
Evidence
- An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior; a specifically malformed HTTP request could cause the affected VTScada to crash, affecting both LAN-only and internet-facing systems. — NVD
- NVD Primary CVSS v3.1 score 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; CISA ICS-CERT recorded an identical Secondary score and vector. — NVD
- CVE-2022-3181 is documented in CISA ICS advisory ICSA-22-300-04, cited by NVD as a Patch / Third Party Advisory / US Government Resource reference. — CISA ICSA-22-300-04
- Trihedral markets VTScada specifically for water and wastewater utility SCADA, publishing profiles of VTScada monitoring and control deployments at water and wastewater facilities. — Trihedral — Water / Wastewater SCADA Software Case Studies and Stories
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0080 (57.0th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What is the actual impact of exploiting CVE-2022-3181?
A remote attacker who sends a specifically malformed HTTP request can crash the affected VTScada server — a denial-of-service impact rather than data theft, consistent with NVD's confidentiality:none / integrity:none / availability:high scoring (per NVD).
Does exploiting this flaw require authentication or user interaction?
No. NVD's vector shows no privileges required (PR:N) and no user interaction (UI:N), meaning a remote, unauthenticated attacker can trigger the crash directly (per NVD).
Which VTScada deployments are at risk?
Both LAN-only and internet-facing VTScada installations running version 12.0.38 or earlier are affected, per CISA's advisory — network isolation alone does not fully eliminate the risk (per CISA ICSA-22-300-04).
Why is this flaw particularly relevant to water utilities?
Trihedral markets VTScada specifically at water and wastewater utility operators, publishing dedicated case studies of VTScada SCADA deployments at water and wastewater facilities worldwide, so a crash of the server directly affects monitoring and control of that infrastructure (per Trihedral — Water / Wastewater SCADA Software Case Studies and Stories).