SCADAPack Secure Lock fixture verifier

This repository is a deliberately bounded proof of concept for CVE-2026-81861. It verifies that two controlled fixtures produced with the vendor's shipped Windows DTM can be authenticated and decoded using common key material.

It is not an operational exploit. It contains no network client, device target, DNP3 transmitter, unlock operation, message-forging command, capture scanner, or arbitrary-file decryptor. It cannot contact or change an RTU.

Demonstrated result

The verifier accepts only these exact bundled files, pinned by SHA-256:

• samples/vendor_generated/vendor_message_s1.bin: complete message produced by the vendor DTM's own message initializer.
• samples/vendor_generated/harnessB_vendor_ciphertext_and_mac.bin: ciphertext and MAC produced by vendor cryptographic routines over researcher-assembled product-format bytes.

Neither file came from a physical RTU. They demonstrate interoperability with the shipped DTM implementation, not live-device acceptance or network exploitability.

Key handling

Production constants and keys are not included. A researcher who already has authorized access to the affected software may supply a local JSON file:

{
  "hmac_sha256_key": "<64 hex characters>",
  "aes128_kek": "<32 hex characters>"
}

Do not commit that file. Run the bounded verification with:

python3 securelock_poc.py verify-fixtures --key-file /path/to/local-keys.json

The command rejects any file not named in its fixture allowlist and checks the SHA-256 digest before parsing. It never prints supplied keys.

Tests

python3 tests/test_vectors.py

The default suite uses public AES/RFC 3394 test vectors and non-production test keys. If SECURELOCK_FIXTURE_KEY_FILE names a valid local key file, it also verifies both vendor-generated fixtures; otherwise those tests are skipped.

Scope and limitations

• Confirmed here: digest-gated fixture parsing, AES decryption, RFC 3394 unwrap, strict bounds, and optional recovery from two vendor-DTM fixtures.
• Not demonstrated: RTU traffic, live interoperability, device acceptance, access to protected functionality, or any state change.

See Schneider Electric advisory SEVD-2026-251-03 for affected products, mitigations, and vendor guidance.