The code exploits a flaw in Citect’s CitectSCADA software that was originally discovered by Core Security Technologies and made public in June.