Key takeaways
- CISA published these as ICSA-18-107-02, with the current version (Update B) last revised 18 December 2018, affecting Tricon MP (Main Processor) Model 3008 firmware versions 10.0 through 10.4.
- Isolate the safety network completely.
TriStation is the proprietary protocol Schneider Electric's Triconex safety instrumented system (SIS) controllers use to communicate with their own engineering software, and per CISA's own joint report with Schneider Electric, it "does not require any authentication or encryption." That gap is not theoretical: it is the protocol TRITON/TRISIS, the first publicly known malware built specifically to attack a safety instrumented system, used to reprogram Triconex controllers in 2017 — and no vendor update has since added authentication to the protocol itself.
This guide draws on CISA's joint Malware Analysis Report with Schneider Electric, CISA's published ICS advisory, Schneider Electric's own security notifications, FireEye/Mandiant's public incident reporting, and MITRE ATT&CK for ICS, cross-checked against each other. Confirm exact clause wording and current firmware status against the primary sources linked above before relying on this guide for a specific deployment.
What is TriStation, and why does it have no authentication?
TriStation 1131 is the engineering software Schneider Electric built for programming and communicating with Triconex Tricon, Tri-GP and Trident safety controllers — the controllers whose entire job is to monitor an industrial process and force it to a safe state (an emergency shutdown, for example) when something goes wrong. The protocol it speaks runs over UDP port 1502 and, per CISA's Malware Analysis Report MAR-17-352-01 (produced jointly with Schneider Electric), "does not require any authentication or encryption." Where access control lists exist on the controller, CISA's report describes them as based solely on the source IP address — not a credential, certificate or signed command — and states plainly that the controller accepts TriStation commands "regardless of key switch position," meaning the physical keyswitch most engineers assume gates reprogramming does not actually enforce that at the protocol level.
What happened in the 2017 TRITON/TRISIS attack?
FireEye's 14 December 2017 report, "Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure," was the first public account: a custom attack framework, communicating over the undocumented TriStation protocol, used to interact with and reprogram Triconex SIS controllers — the first publicly documented malware purpose-built to target a safety system specifically, rather than a conventional ICS or IT target. CISA's own Malware Analysis Report, MAR-17-352-01 (original publication 18 December 2017; Update A, 10 April 2018; Update B, 27 February 2019), names the malware HatMan; Dragos's independently published analysis named the same campaign TRISIS, and both names are now used interchangeably in public reporting. A later FireEye report (23 October 2018) attributed development support for the attack tooling to a Russian government-owned research institute, the Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM).
What vulnerabilities and advisories did the incident produce?
| CVE | CVSS v3 (CISA / NVD) | Weakness | Fixed in |
|---|---|---|---|
| CVE-2018-8872 | 9.0 / 8.1 | Buffer overflow from unchecked system calls copying data into memory (CWE class varies by source) | Tricon CX v11.4 (Oct. 2018) |
| CVE-2018-7522 | 7.9 / 6.7 | Local privilege escalation: registers stored at a fixed, predictable memory location | Tricon CX v11.4 (Oct. 2018) |
CISA published these as ICSA-18-107-02, with the current version (Update B) last revised 18 December 2018, affecting Tricon MP (Main Processor) Model 3008 firmware versions 10.0 through 10.4. NVD's independently recalculated CVSS scores differ from CISA's own because NVD scores both with an unchanged (rather than CISA's changed) impact scope — both scores describe the same underlying flaws. Separately, Schneider Electric's own security notification SEVD-2017-347-01 went through three revisions, from 13 December 2017 through the current v3 dated 14 December 2018, as the vendor's own investigation and guidance matured alongside CISA's.
Is TriStation / TRITON tracked in MITRE ATT&CK for ICS?
Yes. MITRE's ATT&CK for ICS catalogs the malware as Software S1009, "Triton," with aliases TRISIS and HatMan (an earlier ID, S0609, was created in error on the Enterprise matrix and has been deprecated — it is not the correct reference). ATT&CK links it to intrusion-set G0088, TEMP.Veles (also tracked as XENOTIME), and to campaign C0030, "Triton Safety Instrumented System Attack," dated June through August 2017. Among the techniques ATT&CK associates with it: T0858 (Change Operating Mode), T0880 (Loss of Safety), T0821 (Modify Controller Tasking), T0843 (Program Download) and T0845 (Program Upload) — a list that reads, in effect, as "everything TriStation lets an unauthenticated sender on the network do to a safety controller."
A workable starting point
Because no vendor update has added authentication to TriStation itself, every mitigation CISA and Schneider Electric recommend is physical or architectural, not cryptographic:
Keep the Tricon keyswitch out of PROGRAM modeexcept during active, supervised engineering work, and configure operator-station alarms to flag whenever it's left in that position — Schneider Electric's own SEVD-2017-347-01 states this directly. Isolate the safety network completelyTriStation engineering workstations should connect to no network other than the safety network itself, and removable media should be scanned before it ever touches that workstation. Keep safety controllers physically locked downCabinet access control matters as much as network controls when the protocol itself has none. Patch to Tricon CX v11.4for the 2018 CVEs above, and apply Schneider's 2020 bulletin SESB-2020-105-01 fixes (CVE-2020-7483, CVE-2020-7484, CVE-2020-7485) on any legacy Triconex 1131 software still in use. Minimize network exposure for the SIS entirely— the same baseline NIST SP 800-82's OT security guidance applies to every safety or control-system network, and here it matters more than usual, since the system in question is the one meant to catch everything else going wrong.
SoftWSP's OT Snapshot passively analyzes captured OT traffic using Zeek and CISA's own ICSNPP protocol analyzers — Modbus, BACnet, S7comm, EtherNet/IP and DNP3 today — flagging risky behavior such as cleartext protocol use and unexpected write or program-download commands, with the AI-assisted report citing the exact traffic behind each finding. TriStation's UDP/1502 traffic has no dedicated ICSNPP analyzer yet, so a capture from a Triconex safety network currently shows connection-level facts rather than a decoded view of TriStation commands — for example, whether anything beyond the engineering workstation is reaching the SIS on that port at all. See OT Snapshot for what a passive capture actually returns today.
This guide is not a substitute for CISA's or Schneider Electric's own published advisories and bulletins, MITRE ATT&CK's live entries, or an engineer's assessment of a specific Triconex deployment.
Sources
- CISA Malware Analysis Report MAR-17-352-01: HatMan — Safety System Targeted Malware (Update B, PDF)
- CISA ICS Advisory ICSA-18-107-02: Schneider Electric Triconex Tricon (Update B; CVE-2018-8872, CVE-2018-7522)
- Schneider Electric Security Notification SEVD-2017-347-01: EcoStruxure Triconex Tricon V3
- Schneider Electric Security Bulletin SESB-2020-105-01: Legacy Triconex Product Vulnerabilities (V2.1, PDF)
- FireEye/Mandiant (Google Cloud): "Attackers Deploy New ICS Attack Framework 'TRITON'..." (14 December 2017)
- FireEye/Mandiant (Google Cloud): "TRITON Attribution: Russian Government-Owned Lab..." (23 October 2018)
- MITRE ATT&CK for ICS: Software S1009, Triton (aliases TRISIS, HatMan)
- NIST Special Publication 800-82 Revision 3, Guide to Operational Technology (OT) Security (September 2023)
Frequently asked questions
What is TriStation, and does it have authentication?
TriStation 1131 is Schneider Electric's engineering software for programming and communicating with Triconex Tricon, Tri-GP and Trident safety instrumented system (SIS) controllers, and the protocol it uses to talk to those controllers runs over UDP port 1502. Per CISA's Malware Analysis Report MAR-17-352-01 ("HatMan — Safety System Targeted Malware," Update B, co-produced with Schneider Electric), "this protocol does not require any authentication or encryption, although access control lists (ACLs) may be configured on the PLC" — and those ACLs are described as based solely on IP address, not a credential. The same report states commands are accepted "regardless of key switch position," meaning the controller's physical PROGRAM/RUN keyswitch, the intended safeguard, does not actually gate what the protocol itself will accept.
What happened in the 2017 TRITON/TRISIS attack?
FireEye (now part of Mandiant/Google Cloud) published the first public account on 14 December 2017, "Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure," describing a custom attack framework built specifically to communicate with Triconex SIS controllers over the undocumented TriStation protocol and manipulate their logic — the first publicly documented malware purpose-built to target a safety instrumented system rather than a conventional control or IT system. CISA's own Malware Analysis Report MAR-17-352-01, originally published 18 December 2017 (Update A: 10 April 2018; Update B: 27 February 2019), analyzed the malware (which CISA names HatMan; Dragos's independent report named the same campaign TRISIS) and confirmed it operated over TriStation. FireEye's later report (23 October 2018) attributed development support to a Russian government-owned research institute, the Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM).
What vulnerabilities and advisories came out of the TRITON/TRISIS incident?
CISA's ICSA-18-107-02 ("Schneider Electric Triconex Tricon," Update B, last revised 18 December 2018) assigns two CVEs against Tricon MP (Main Processor) Model 3008 firmware versions 10.0 through 10.4: CVE-2018-8872, a buffer overflow from unchecked system calls copying data into memory (CISA's own CVSS v3 score 9.0; NVD's independent recalculation, using an unchanged rather than changed scope, gives 8.1), and CVE-2018-7522, a local privilege-escalation flaw from registers stored at a fixed, predictable memory location (CISA: 7.9; NVD: 6.7). Both are fixed in Tricon CX v11.4, released October 2018 and built to align with IEC 62443. Schneider Electric's own security notification, SEVD-2017-347-01, went through three revisions (13 December 2017 through the current v3 of 14 December 2018) as the investigation progressed.
Is TriStation / TRITON tracked in MITRE ATT&CK for ICS?
Yes, under Software ID S1009, named "Triton" with aliases TRISIS and HatMan (an earlier Enterprise-domain ID, S0609, was deprecated and is not the correct reference). It's linked to intrusion-set G0088, TEMP.Veles (also known as XENOTIME), and to campaign C0030, "Triton Safety Instrumented System Attack," dated June through August 2017. The associated ATT&CK for ICS techniques include T0858 (Change Operating Mode), T0880 (Loss of Safety), T0821 (Modify Controller Tasking), T0843 (Program Download) and T0845 (Program Upload) — all describing actions the TriStation protocol permits to anyone who can reach the controller on UDP port 1502, with no credential required.
What should an asset owner running Triconex SIS controllers check first?
No update has added authentication to the TriStation protocol itself, so the controls that matter remain physical and architectural. Schneider Electric's own guidance (SEVD-2017-347-01) is specific: keep the Tricon keyswitch out of PROGRAM mode except during active, supervised engineering work, and configure operator-station alarms to flag whenever it is in that mode; keep safety controllers in locked cabinets with physical access control; never connect a TriStation engineering workstation to any network other than the safety network itself, and scan any removable media before it touches that workstation. On top of that, CISA's ICSA-18-107-02 recommends patching to Tricon CX v11.4 and, as with every safety instrumented system, minimizing network exposure so the SIS is never reachable from the internet. Separately, Schneider's 2020 bulletin SESB-2020-105-01 addresses three further legacy TriStation 1131 vulnerabilities (CVE-2020-7483, CVE-2020-7484, CVE-2020-7485) — a password feature that exposed data on the network, a denial-of-service condition if keyswitch guidance isn't followed, and a legacy support account with inappropriate project-file access.
In this cluster
Questions about this page?