Sizzler: Sequential fuzzing in ladder diagrams for vulnerability detection and discovery in Programmable Logic Controllers

Oct 25, 2026

Uploaded by noah

Programmable Logic Controllers (PLCs) power Industrial Control Systems across energy, manufacturing, and other critical sectors, yet current PLC vulnerability assessment relies on limited empirical observations and constrained by proprietary vendor firmware routines. Sizzler proposes a vendor-independent vulnerability discovery framework for PLC ladder-diagram logic, combining mutation-based fuzzing with Sequential Generative Adversarial Network (SeqGAN). It refines QEMU GPIO and I2C evaluation to test 30 ladder programs across multiple MCUs, identifies vulnerabilities, and reports a CVE while comparing against Magma and LAVA-M to show broader embedded-system applicability and key limitations.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages14

Reading Time35 min

AccessFree to download

Abstract

I. Introduction

Sizzler: Sequential fuzzing in ladder diagrams for vulnerability detection and discovery in Programmable Logic Controllers Kai Feng , Student Member, IEEE, Marco M. Cook , Member, IEEE, and Angelos K. Marnerides , Member, IEEE Abstract—Programmable Logic Controllers (PLCs) constitute the basis of Industrial Control Systems (ICSs) underpinning sectors ranging from nuclear, up to energy and manufacturing. Currently, PLC vulnerability assessment practices employed by ICS operators are limited due to their reliance on empirical observations of visible code crashes prompted by PLC compilers. In parallel, the prevalent PLC firmware dependency on proprietary vendor routines restricts the composition of generic vulnerability detection or discovery schemes for zero-day threat vectors. In this work, we propose Sizzler: a novel vendor-independent vulnerability discovery framework specific to PLC applications operating with logic realised through ladder diagrams. Sizzler extends the current state of the art by proposing the optimal synergy of a mutationbased fuzzing strategy using Sequential Generative Adversarial Network (SeqGAN). By virtue of critical vendor restrictions on emulating PLC firmware, we also refine the Quick Emulator (QEMU)’s General Purpose I/O (GPIO) and the Inter-Integrated Circuit (I2C) protocols to evaluate and compare Sizzler across 30 PLC ladder diagram programs compiled from LDmicro and OpenPLC projects over five widely used Micro-Controller Units (MCUs). It is noteworthy that Sizzler has successfully identified vulnerabilities in ladder diagrams within a relatively short timeframe based on our proprietary dataset and secured a CVEID. Moreover, through a comparison of Sizzler with prevalent fuzzing techniques over the commonly used Magma and LAVA-M datasets we exhibit its wider applicability on embedded systems and identify its limitations. Index Terms—Industrial Control Systems, Programmable Logic Controllers, Fuzzing, Vulnerability discovery I. Introduction INDUSTRIAL Control Systems (ICS) are the backbone for a variety of mission-critical infrastructures and services spanning across multiple sectors serving modern socio-technical societies (for instance, energy, utilities, and defence) . While ICS were traditionally isolated systems, they have become more interconnected with conventional Information Technology (IT) environments using commodity software and hardware, resulting in higher productivity. Nonetheless, this convergence has naturally enlarged the cyber threat spectrum and consequently increased systemic and zero-day vulnerabilities that enable attackers to exploit critical ICS components, such Kai Feng and Dr. Marco Cook are with the School of Computing Science, University of Glasgow, Glasgow, Scotland, G12 8RZ (e-mail: [k.feng.2@research.gla.ac.uk](k.feng.2@research.gla.ac.uk), [marco.cook@glasgow.ac.uk](marco.cook@glasgow.ac.uk)). Dr. Angelos Marnerides is with the Department of Electrical & Computer Engineering, KIOS Research & Innovation Centre of Excellence, University of Cyprus, Nicosia, Cyprus ([e-mail: marnerides.angelos@ucy.ac.cy](e-mail: marnerides.angelos@ucy.ac.cy)). as Programmable Logic Controllers (PLCs) . PLCs are vital to the control, instrumentation, and automation of real-time ICS operations with minimal latency. Evidently, PLCs have been a prime target in recent zero-day exploits leading to receiving considerable attention from the research community [1] . Commonly, PLC firmware underpinning PLC application code is dictated by pre-defined proprietary instruction sets embedded by manufacturers and the greatest majority of PLCs map their application logic to physical ICS processes through ladder diagrams. Existing literature has identified that commercial PLCs lack fundamental security checks during the compilation of ladder diagrams [2] . Thus, PLCs are subject to various vulnerabilities, such as timer condition competition, unreachable code, and hidden jumpers [

FAQs

What limitation in existing PLC vulnerability assessment does Sizzler target?

Existing practices are limited by reliance on empirical observations of visible crashes and by proprietary vendor firmware dependencies, which restrict generic vulnerability detection or discovery for zero-day threats.

How does Sizzler generate test inputs for ladder-diagram PLC logic?

Sizzler uses mutation-based fuzzing enhanced by a Sequential Generative Adversarial Network (SeqGAN) to learn the mutation logic on executed PLC code.

What evaluation setup does the work use to compare Sizzler?

The approach refines Quick Emulator (QEMU) GPIO and I2C protocol handling and evaluates Sizzler across 30 PLC ladder-diagram programs compiled from LDmicro and OpenPLC over five widely used MCUs.

Oct 25, 2026

Uploaded by noah