Security Experts:

Connect with us

Hi, what are you looking for?



ICS Exploits Earn Hackers $400,000 at Pwn2Own Miami 2022

ICS Pwn2Own 2022

Pwn2Own Miami 2022, a hacking contest focusing on industrial control systems (ICS), has come to an end, with contestants earning a total of $400,000 for their exploits.

ICS Pwn2Own 2022

Pwn2Own Miami 2022, a hacking contest focusing on industrial control systems (ICS), has come to an end, with contestants earning a total of $400,000 for their exploits.

The contest, organized by Trend Micro’s Zero Day Initiative (ZDI), saw 11 contestants demonstrating their exploits in the OPC UA Server, Control Server, Human Machine Interface, and Data Gateway categories.

Participants demonstrated a total of 26 unique zero-day exploits against products from Unified Automation, Iconics, Inductive Automation, Prosys, Aveva, Triangle MicroWorks, OPC Foundation, Kepware, and Softing.

A majority of the 32 hacking attempts were successful — two failed and eight involved previously known bugs. These “bug collisions” still earned participants $5,000 for each attempt.

The white hat hackers who attended the event earned either $20,000, typically for remote code execution vulnerabilities, or $5,000, for DoS vulnerabilities. There was only one exception. The Computest Sector 7 team earned $40,000 for successfully bypassing the trusted application check on the OPC UA .NET standard.

This was the maximum amount that Pwn2Own participants could earn for a single exploit, and Computest’s attempt involved what ZDI described as one of the most interesting bugs ever seen at Pwn2Own. In fact, the Computest team earned the most points and a total of $90,000.

In 2020, at the first edition of the ICS-themed Pwn2Own, participants earned a total of $280,000. This event was not held in 2021 due to the COVID-19 pandemic.

Pwn2Own Miami 2022 took place between April 19 and April 21 alongside the S4x22 ICS security conference.

Related: Serious Vulnerability Exploited at Hacking Contest Impacts Over 200 HP Printers

Related: Device Exploits Earn Hackers Over $1 Million at Pwn2Own Austin 2021

Related: $1.9 Million Paid Out for Exploits at China’s Tianfu Cup Hacking Contest

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.


Otorio has released a free tool that organizations can use to detect and address issues related to DCOM authentication.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.